CVSS 10.0 CVE in React & Next.js. Get a free patch!

A critical CVSS 10.0 remote code execution vulnerability (CVE-2025-55182) was disclosed in React and Next.js. It lets unauthenticated attackers execute code by sending malformed payloads to React Server Components and Server Function endpoints. Nearly 40% of cloud environments are exposed, some versions lack official fixes, and apps can be vulnerable even if they don't use Server Functions directly. Seal Security provides an immediate backported patch for all affected versions, including canary and legacy builds.

Key facts

• Affects React 19.x and Next.js 14.3 canary, 15.x and 16.x.
• Exploitable without authentication through React's deserialization process.
• Some affected versions have no stable patched release.
• Upgrading frameworks can introduce breaking changes and delays.
• Seal delivers upgrade-free remediation across all affected versions.

Get your free patch

Seal backports the fix into the React and Next.js versions you already run, with no framework upgrade. Fill in the form on this page to get your free patch for CVE-2025-55182, or book a demo to see how Seal fixes the rest of your backlog.