Critical vulnerability in React Server Components (CVE-2025-55182)

This alert is relevant to all Australian businesses and organisations.

This alert contains a combination of simple and moderately complex technical advice, intended for business owners and technical IT support services.

Background 

ASD’s ACSC is aware of a critical vulnerability in React Server Components, which is used extensively in modern web applications.

CVE-2025-55182 enables an attacker to achieve unauthenticated Remote Code Execution (RCE) in vulnerable versions of the following packages:

• react-server-dom-webpack
• react-server-dom-parcel
• react-server-dom-turbopack

Mitigation advice

Australian organisations should review their networks for vulnerable instances of these packages and upgrade to fixed versions as outlined here: React security blog.

Where to get help

Organisations that have been impacted, suspect impact or require advice and assistance can contact us via  1300 CYBER1 (1300 292 371).