< Resource lobby

CVSS 10.0 CVE in React & Next.js. Get a free patch!

A critical CVSS 10.0 RCE vulnerability (CVE-2025-55182) was disclosed in React and Next.js, allowing unauthenticated attackers to execute code through malformed payloads sent to React Server Components and Server Function endpoints. Get your free patch for CVE-2025-55182, secure your React and Next.js apps.

A critical CVSS 10.0 RCE vulnerability (CVE-2025-55182) was disclosed in React and Next.js, allowing unauthenticated attackers to execute code through malformed payloads sent to React Server Components and Server Function endpoints. With nearly 40% of cloud environments exposed and some versions lacking official fixes, teams may be vulnerable even without directly using Server Functions. Seal Security now provides an immediate backported patch for all affected versions, including canary and legacy builds.

‍

  • Impacts React 19.x and Next.js 14.3 canary, 15.x, and 16.x.
  • Exploitable without authentication through React’s deserialization process.
  • Some affected versions have no stable patched release available.
  • Updating frameworks can introduce breaking changes and delays.
  • Seal delivers instant, upgrade-free remediation across all environments.

‍

Get your free patch for CVE-2025-55182 and secure your React and Next.js apps.

‍

Get your free patch
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.