Threat Intelligence / CVE / CVE-2025-55182

CVE-2025-55182 — Facebook React 19.0.0

CISA KEVRansomware

CVSS v3.1 10 (CRITICAL) · EPSS 84.8% (higher than 99.3% of all scored CVEs) · Priority 10/10 · Published 2025-12-03

As of 2025-12-10, CVE-2025-55182 is a CRITICAL-severity vulnerability in Facebook React 19.0.0, CVSS v3.1 10, EPSS 84.8% (99.3th percentile). It is listed in the CISA Known Exploited Vulnerabilities catalog (added 2025-12-05), with a US federal remediation deadline of 2025-12-12, and CISA links it to known ransomware campaigns. Threadlinqs Intelligence links 18 tracked threat campaigns to CVE-2025-55182, most recently “The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework (400+ processes, 8 BYOVD variants) and 90% affiliate payouts”.

Last updated: 2025-12-10

What is CVE-2025-55182?

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

The record classifies CVE-2025-55182 under weakness class CWE-502. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality, integrity, availability. 76 affected-product entries are recorded, across 2 vendors, listed below. The identifier was first published 284 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 10 — CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS (FIRST): 84.8% probability of exploitation in the next 30 days, higher than 99.3% of all scored CVEs
CISA KEV: Listed since 2025-12-05, federal remediation deadline 2025-12-12 — used in known ransomware campaigns
Threadlinqs priority: 10/10 — CISA lists it as used in ransomware, which Threadlinqs scores at the maximum
Published: 2025-12-03, last modified 2025-12-10

Is CVE-2025-55182 being exploited?

CISA added CVE-2025-55182 to the Known Exploited Vulnerabilities catalog on 2025-12-05, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2025-12-12 under BOD 22-01. CISA flags the vulnerability as one used in known ransomware campaigns. It currently carries a trending score of 40 in the Threadlinqs vulnerability feed.

Affected products and versions

Facebook: React 19.0.0, React 19.1.0, React 19.1.1, React 19.2.0
Vercel: Next.js, Next.js 14.3.0, Next.js 15.6.0, Next.js 16.0.0

Showing 8 of 76 recorded product entries.

How to fix CVE-2025-55182

The record marks a vendor fix as available for CVE-2025-55182. Patch reference: https://github.com/facebook/react/security/advisories/GHSA-5rqg-jjc5-m7x2. Vendor advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components. Because CVE-2025-55182 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2025-12-12. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

Threat activity tracking CVE-2025-55182

18 tracked threats in the Threadlinqs corpus reference CVE-2025-55182, either in the campaign’s CVE list or as an indicator on the campaign record.

The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework (400+ processes, 8 BYOVD variants) and 90% affiliate payouts — HIGH · 2026-07-14
FulcrumSec Double-Extortion Data Theft of Global Schools Foundation (GSF) EdTech Network via Unrotated 2022 MongoDB Credentials — HIGH · 2026-07-11
The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program — CRITICAL · 2026-07-06
Fake IT Support Calls on Microsoft Teams Push EtherRAT — Node.js RAT Using EtherHiding (Ethereum Smart Contract C2), Linked to React2Shell (CVE-2025-55182) Exploitation Chain — HIGH · 2026-07-06
SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt Strike — HIGH · 2026-07-03
ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python Packages to Backdoor Security Researchers — HIGH · 2026-07-02
ChocoPoC Campaign: Trojanised PoC Exploits and PyPI Packages Deliver Python RAT Using Mapbox Datasets API as Dead-Drop C2 — HIGH · 2026-07-02
ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits Targeting Security Researchers — HIGH · 2026-07-01
SharkLoader Malware Deploys Cobalt Strike Beacon via DLL Side-Loading in StrikeShark Campaign — HIGH · 2026-06-27
SHADOW-EARTH-053 — China-Aligned Cyberespionage Campaign Exploiting Microsoft Exchange (ProxyLogon CVE-2021-26855/26857/26858/27065) and IIS to Deploy GODZILLA Web Shells and ShadowPad — HIGH · 2026-05-11
PCPJack Worm — Cloud Credential Theft Framework Evicting TeamPCP Infections (CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703) — CRITICAL · 2026-05-07
Bissa Scanner — AI-Assisted Mass Exploitation of CVE-2025-55182 (React Server Components RCE) and CVE-2025-9501 (W3 Total Cache) — CRITICAL · 2026-04-27
Bissa Scanner — AI-Assisted Mass Exploitation and Credential Harvesting Campaign (@BonJoviGoesHard / Dr. Tube) — HIGH · 2026-04-22
Escalating Kubernetes Attacks: React2Shell (CVE-2025-55182), Slow Pisces, and Cloud-Native Threat Actors — CRITICAL · 2026-04-06
TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payload — CRITICAL · 2026-03-31
EtherRAT — Node.js Backdoor with Ethereum Blockchain C2 (EtherHiding) Linked to DPRK Contagious Interview — CRITICAL · 2026-03-27
TeamPCP Partners With Vect Ransomware Group to Escalate Cross-Ecosystem Open Source Supply Chain Attacks — CRITICAL · 2026-03-26
React2Shell CVE-2025-55182 — Multiple Threat Actors Actively Exploiting React Server Components RCE (CVSS 10.0) — CRITICAL · 2026-02-13

Sources

Seeded from kev and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.

Full detection coverage & IOCs for threats exploiting CVE-2025-55182 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence