---
id: "CVE-2025-55182"
kind: "vulnerability"
aliases: ["CVE-2025-55182"]
title: "A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0,\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Meta React Server Components", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "facebook react", "fixed": [], "affected": "= 19.0.0", "ecosystem": "vendor"}, {"name": "facebook react", "fixed": [], "affected": "= 19.1.0", "ecosystem": "vendor"}, {"name": "facebook react", "fixed": [], "affected": "= 19.1.1", "ecosystem": "vendor"}, {"name": "facebook react", "fixed": [], "affected": "= 19.2.0", "ecosystem": "vendor"}, {"name": "vercel next.js", "fixed": ["15.0.5"], "affected": ">= 15.0.0, < 15.0.5", "ecosystem": "vendor"}, {"name": "vercel next.js", "fixed": ["15.1.9"], "affected": ">= 15.1.0, < 15.1.9", "ecosystem": "vendor"}, {"name": "vercel next.js", "fixed": ["15.2.6"], "affected": ">= 15.2.0, < 15.2.6", "ecosystem": "vendor"}, {"name": "vercel next.js", "fixed": ["15.3.6"], "affected": ">= 15.3.0, < 15.3.6", "ecosystem": "vendor"}, {"name": "vercel next.js", "fixed": ["15.4.8"], "affected": ">= 15.4.0, < 15.4.8", "ecosystem": "vendor"}, {"name": "vercel next.js", "fixed": ["15.5.7"], "affected": ">= 15.5.0, < 15.5.7", "ecosystem": "vendor"}, {"name": "vercel next.js", "fixed": ["16.0.7"], "affected": ">= 16.0.0, < 16.0.7", "ecosystem": "vendor"}, {"name": "vercel next.js", "fixed": [], "affected": "= 14.3.0", "ecosystem": "vendor"}, {"name": "vercel next.js", "fixed": [], "affected": "= 15.6.0", "ecosystem": "vendor"}, {"name": "vercel next.js", "fixed": [], "affected": "= 16.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["akamai", "exploited", "lab-disclosure", "next.js", "package", "ransomware", "react", "react-server-components", "self-hosted"]
not_affected_if: ["no-server-functions", "static-export"]
published_at: "2025-12-03T16:15:56+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T18:43:45+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-55182", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55182", "first_seen_at": "2026-10-23T23:44:51+00:00"}, {"source": "lab", "url": "https://www.akamai.com/blog/security/2026/aug/zero-day-akamai-defends-before-industry-discloses", "first_seen_at": "2026-10-24T18:43:45+00:00"}]
---

# A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0,…

React Server Components decode payloads sent to Server Function endpoints in an unsafe way, letting an unauthenticated remote client execute code on the server. CISA lists it as actively exploited and tagged with ransomware use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Meta React Server Components affected ? fixed ?
- vendor:facebook react affected = 19.0.0 fixed ?
- vendor:facebook react affected = 19.1.0 fixed ?
- vendor:facebook react affected = 19.1.1 fixed ?
- vendor:facebook react affected = 19.2.0 fixed ?
- vendor:vercel next.js affected >= 15.0.0, < 15.0.5 fixed 15.0.5
- vendor:vercel next.js affected >= 15.1.0, < 15.1.9 fixed 15.1.9
- vendor:vercel next.js affected >= 15.2.0, < 15.2.6 fixed 15.2.6
- vendor:vercel next.js affected >= 15.3.0, < 15.3.6 fixed 15.3.6
- vendor:vercel next.js affected >= 15.4.0, < 15.4.8 fixed 15.4.8
- vendor:vercel next.js affected >= 15.5.0, < 15.5.7 fixed 15.5.7
- vendor:vercel next.js affected >= 16.0.0, < 16.0.7 fixed 16.0.7
- vendor:vercel next.js affected = 14.3.0 fixed ?
- vendor:vercel next.js affected = 15.6.0 fixed ?
- vendor:vercel next.js affected = 16.0.0 fixed ?

## Fix

Apply the mitigation or patched React Server Components version per vendor instructions; the sources do not name the version. If no mitigation is available, discontinue use of the affected product per CISA guidance.

## Mitigated for you by

- Akamai (waf-rule, since 2025-12-02): covers Core safeguards for CVE-2025-55182 deployed via Rapid Rule 3000976, later iterated as v1, v2 and v3 over December 4-5, 2025 Limits: none stated Still: none stated in the document https://www.akamai.com/blog/security/2026/aug/zero-day-akamai-defends-before-industry-discloses

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-55182
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-55182
- 2026-10-24T18:43:45+00:00 lab https://www.akamai.com/blog/security/2026/aug/zero-day-akamai-defends-before-industry-discloses — Akamai: Zero-Day Dominance: How Akamai Defends Before the Industry Discloses | Akamai

## Documents

- [advisory] Akamai: Zero-Day Dominance: How Akamai Defends Before the Industry Discloses | Akamai https://www.akamai.com/blog/security/2026/aug/zero-day-akamai-defends-before-industry-discloses

## From the sources

Zero-Day Dominance: How Akamai Defends Before the Industry Discloses | Akamai

# Zero-Day Dominance: How Akamai Defends Before the Industry Discloses 

 August 28, 2026 by Danielle Walter 

## Key takeaways 

Modern zero-day defense requires moving beyond disconnected point products to a unified web application and API protection (WAAP) platform with shared intelligence.
Multi-day deployment delays leave live enterprise systems exposed to machine-speed attacks, while unvalidated global updates risk triggering severe false positives and catastrophic application downtime.
The Akamai Security Intelligence Group is capable of delivering proactive inline protection days before public vulnerability disclosure and competitor signature releases.
Achieving structural resilience relies on staged validation — combining synthetic lab testing, edge shadow mode, and phased zone rollouts — to provide rapid defense while maintaining total platform availability.

Every modern business runs on applications, which means that your digital operations are only as safe as your ability to block an exploit before the industry even knows it exists. Attackers, whether human or AI-assisted, are no longer limited to testing your web application firewall (WAF) with basic injections; they are executing complex campaigns that chain together automated botnets, API vulnerabilities, and zero-days to compromise live back-end logic.

For security leaders, stopping these fast-moving threats requires transcending disconnected point products and shifting to a unified architecture with a shared data model.

For enterprise buyers, the benchmark for application defense has fundamentally shifted from individual point product efficacy to the operational synergy of a unified web application protection platform.

Achieving structural resilience demands a shared architectural context and a cohesive data model capable of interaction-time decision-making. Akamai’s proactive zero-day mitigation model evaluates the structural architectural discrepancies that separate true platform reliability from fragile, un-staged security deployment models.

## Proactive vs. reactive vulnerability lifecycles 

When high-profile Common Vulnerabilities and Exposures (CVEs) surface, the window between public disclosure and global weaponization shrinks dramatically. Insight across several major exploit lifecycles illustrates the clear operational gap between proactive threat intelligence and reactive emergency rule patching.

When a zero-day vulnerability goes live, response speed becomes a critical factor in reducing risk exposure. Let’s explore the timelines from two major exploit lifecycles to evaluate how threat interception agility splits the application security market.

- The Apache Camel vulnerability lifecycle (March 2025)
- The React Server Components vulnerability lifecycle (December 2025)

### The Apache Camel vulnerability lifecycle (March 2025) 

When critical infrastructure vulnerabilities break, enterprise risk exposure is calculated in elapsed hours. The disclosure and mitigation tracking for the Apache Camel remote code execution (RCE) vulnerabilities (CVE-2025-29891 and CVE-2025-27636) demonstrate the immense delta in response execution between a proactive platform and reactive signatures.

- Friday, March 7: After collaborating with Apache, the Akamai Security Intelligence Group deployed a Rapid Rule, proactive inline protection mechanisms from day zero, that remained under embargo until March 9.
- Sunday, March 9: Following a 48-hour weekend exposure gap, F5 positioned its initial defensive protections.
- Tuesday, March 11

- Cloudflare pushed its mitigation updates online. For highly targeted enterprise environments, this represents a significant four-day structural vacuum during which core application assets were left exposed to active threat scanning. However, they revisited this update in a blog post nearly a month later (see The true cost of inaccuracy).
- Akamai worked closely with Citi Cyber Security Operations to identify and report the bypass to the Apache security team — resulting in a new CVE (CVE-2025-27636), with protection updates deployed to the original Rapid Rule to cover both CVEs. 
- Wednesday, March 12: Nearly a week after discovery, competitive tracking confirmed that major vendors such as Fastly and Imperva still possessed no active defensive counter measures or public indicators.

The true cost of inaccuracy A delayed security response can increase customer operational burden as teams implement temporary mitigations while waiting for vendor protections. The expectation is that when those protections arrive, they will be accurate and reliable. The Apache Camel response illustrates the consequences when both speed and detection accuracy fall short.

Nearly a month after the initial discovery, Cloudflare posted that its reactive rule actions for Apache Camel (CVE-2025-29891) induced massive system instability across their network. Lacking staged validation on real traffic data, the rule triggered high false-positive rates that blocked legitimate customer transactions until their security operations center completely pulled the kill switch and disabled protection at 17:03 UTC.

### The React Server Components vulnerability lifecycle (December 2025) 

The vulnerabilities hitting server-side web frameworks in late 2025 brought threats directly up the application stack, turning standard web actions into code execution bypasses. The mitigation and update log for CVE-2025-55182 outlines the difference between real-time security iteration and unvalidated production updates.

- Monday, December 2: Akamai deployed core safeguards into the environment via Rapid Rule 3000976, keeping public communications under strict embargo until Tuesday, December 3. Cloudflare asserted an identical protective baseline deployment date in a late post on December 3.
- Tuesday, December 3: AWS pushed their public threat signature update online.
- Wednesday, December 4 – Thursday, December 5: Rather than treating mitigation as a one-time rule deployment, the Akamai Security Intelligence Group continuously monitored exploitation activity, analyzed emerging attack variants, and released three successive rule iterations (v1, v2, v3) over a 48-hour window. This agile approach adapted protections to the evolving threat while maintaining high enforcement accuracy.
- Thursday, December 4: F5, Imperva, and Google deployed defensive protections into their stacks.
- Friday, December 5: Microsoft Azure rolled out their protection rules. Concurrently, Cloudflare released an untested global update to their security system regarding CVE-2025-55182. Without staged canary testing or validation, the signature change triggered an active loop failure, inducing a significant outage that took customer applications entirely offline.

## The structural implications of reactive vs. staged security postures 

The data from these threat lifecycles strips away marketing hyperbole and exposes a fundamental operational truth: A security control that compromises availability during a threat event can become a source of operational risk itself. Security effectiveness is measured by both detection efficacy and by the platform's ability to safely deploy, validate, and isolate protections as threats evolve.

Organizations that rely on an application protection platform with delayed response cycles or architectures with rule-processing failures inherently accept two compounding structural vulnerabilities, including:

- The exposure vacuum
- Blast radius vulnerability

### The exposure vacuum 

A multi-day delay in zero-day rule deployment leaves live systems completely defenseless while adversaries weaponize open source scanners at machine speed. In high-stakes web environments, assuming that an exploit won't hit your endpoints during a 48- to 96-hour window is a massive corporate gamble.

### Blast radius vulnerability 

Web application ar

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_