Live › vulnerability › CVE-2025-55182
Go to dashboardReact Server Components decode payloads sent to Server Function endpoints in an unsafe way, letting an unauthenticated remote client execute code on the server. CISA lists it as actively exploited and tagged with ransomware use.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Meta React Server Components | vendor | – | – |
| facebook react | vendor | = 19.0.0 | – |
| facebook react | vendor | = 19.1.0 | – |
| facebook react | vendor | = 19.1.1 | – |
| facebook react | vendor | = 19.2.0 | – |
| vercel next.js | vendor |
| >= 15.0.0, < 15.0.5 |
| 15.0.5 |
| vercel next.js | vendor | >= 15.1.0, < 15.1.9 | 15.1.9 |
| vercel next.js | vendor | >= 15.2.0, < 15.2.6 | 15.2.6 |
| vercel next.js | vendor | >= 15.3.0, < 15.3.6 | 15.3.6 |
| vercel next.js | vendor | >= 15.4.0, < 15.4.8 | 15.4.8 |
| vercel next.js | vendor | >= 15.5.0, < 15.5.7 | 15.5.7 |
| vercel next.js | vendor | >= 16.0.0, < 16.0.7 | 16.0.7 |
| vercel next.js | vendor | = 14.3.0 | – |
| vercel next.js | vendor | = 15.6.0 | – |
| vercel next.js | vendor | = 16.0.0 | – |
Unknown from the sources.
What vendors did on their customers’ behalf. Holds only for traffic through them; patching is still the fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Zero-Day Dominance: How Akamai Defends Before the Industry Discloses | Akamai
August 28, 2026 by Danielle Walter
Modern zero-day defense requires moving beyond disconnected point products to a unified web application and API protection (WAAP) platform with shared intelligence. Multi-day deployment delays leave live enterprise systems exposed to machine-speed attacks, while unvalidated global updates risk triggering severe false positives and catastrophic application downtime. The Akamai Security Intelligence Group is capable of delivering proactive inline protection days before public vulnerability disclosure and competitor signature releases. Achieving structural resilience relies on staged validation — combining synthetic lab testing, edge shadow mode, and phased zone rollouts — to provide rapid defense while maintaining total platform availability.
Every modern business runs on applications, which means that your digital operations are only as safe as your ability to block an exploit before the industry even knows it exists. Attackers, whether human or AI-assisted, are no longer limited to testing your web application firewall (WAF) with basic injections; they are executing complex campaigns that chain together automated botnets, API vulnerabilities, and zero-days to compromise live back-end logic.
For security leaders, stopping these fast-moving threats requires transcending disconnected point products and shifting to a unified architecture with a shared data model.
For enterprise buyers, the benchmark for application defense has fundamentally shifted from individual point product efficacy to the operational synergy of a unified web application protection platform.
Achieving structural resilience demands a shared architectural context and a cohesive data model capable of interaction-time decision-making. Akamai’s proactive zero-day mitigation model evaluates the structural architectural discrepancies that separate true platform reliability from fragile, un-staged security deployment models.
When high-profile Common Vulnerabilities and Exposures (CVEs) surface, the window between public disclosure and global weaponization shrinks dramatically. Insight across several major exploit lifecycles illustrates the clear operational gap between proactive threat intelligence and reactive emergency rule patching.
When a zero-day vulnerability goes live, response speed becomes a critical factor in reducing risk exposure. Let’s explore the timelines from two major exploit lifecycles to evaluate how threat interception agility splits the application security market.
When critical infrastructure vulnerabilities break, enterprise risk exposure is calculated in elapsed hours. The disclosure and mitigation tracking for the Apache Camel remote code execution (RCE) vulnerabilities (CVE-2025-29891 and CVE-2025-27636) demonstrate the immense delta in response execution between a proactive platform and reactive signatures.
Friday, March 7: After collaborating with Apache, the Akamai Security Intelligence Group deployed a Rapid Rule, proactive inline protection mechanisms from day zero, that remained under embargo until March 9.
Sunday, March 9: Following a 48-hour weekend exposure gap, F5 positioned its initial defensive protections.
Tuesday, March 11
Cloudflare pushed its mitigation updates online. For highly targeted enterprise environments, this represents a significant four-day structural vacuum during which core application assets were left exposed to active threat scanning. However, they revisited this update in a blog post nearly a month later (see The true cost of inaccuracy).
Akamai worked closely with Citi Cyber Security Operations to identify and report the bypass to the Apache security team — resulting in a new CVE (CVE-2025-27636), with protection updates deployed to the original Rapid Rule to cover both CVEs.
Wednesday, March 12: Nearly a week after discovery, competitive tracking confirmed that major vendors such as Fastly and Imperva still possessed no active defensive counter measures or public indicators.
The true cost of inaccuracy A delayed security response can increase customer operational burden as teams implement temporary mitigations while waiting for vendor protections. The expectation is that when those protections arrive, they will be accurate and reliable. The Apache Camel response illustrates the consequences when both speed and detection accuracy fall short.
Nearly a month after the initial discovery, Cloudflare posted that its reactive rule actions for Apache Camel (CVE-2025-29891) induced massive system instability across their network. Lacking staged validation on real traffic data, the rule triggered high false-positive rates that blocked legitimate customer transactions until their security operations center completely pulled the kill switch and disabled protection at 17:03 UTC.
The vulnerabilities hitting server-side web frameworks in late 2025 brought threats directly up the application stack, turning standard web actions into code execution bypasses. The mitigation and update log for CVE-2025-55182 outlines the difference between real-time security iteration and unvalidated production updates.
The data from these threat lifecycles strips away marketing hyperbole and exposes a fundamental operational truth: A security control that compromises availability during a threat event can become a source of operational risk itself. Security effectiveness is measured by both detection efficacy and by the platform's ability to safely deploy, validate, and isolate protections as threats evolve.
Organizations that rely on an application protection platform with delayed response cycles or architectures with rule-processing failures inherently accept two compounding structural vulnerabilities, including:
A multi-day delay in zero-day rule deployment leaves live systems completely defenseless while adversaries weaponize open source scanners at machine speed. In high-stakes web environments, assuming that an exploit won't hit your endpoints during a 48- to 96-hour window is a massive corporate gamble.
Web application ar
This page as .md · .json · in your agent: get_signal("CVE-2025-55182")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.