UpHeron
All vulnerabilities

Servers and applications

CVE-2025-55182

RCE in React Server Components

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 5 Dec 2025.

Severity
Critical 10.0
Published
3 Dec 2025
Last changed
17 Dec 2025
Added to UpHeron
3 Nov 2026
Fixed in
16.0.7
Also known as
GHSA-9qr9-h5gf-34mp
Sources
Project advisories (GitHub)

Affected software

SoftwareAffected versions
Next.jsServers and applications · github:vercel/next.js
  • From 16 before 16.0.7

Known exploited

CISA name
Meta React Server Components Remote Code Execution Vulnerability
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due for US agencies
12 Dec 2025
Used in ransomware
Yes, known

References