CVSS 10.0 RCE Rocks the Frontend World: React/Next.js Hit by a Log4Shell‑Level Vulnerability?

Question

December 4th, 2025 — A day the frontend ecosystem won’t forget.

If Log4Shell was Java’s nightmare in 2021, then today’s disclosure of CVE-2025-55182 (with Next.js counterpart CVE-2025-66478) marks the darkest hour of the modern React/Next.js full-stack era.

With a CVSS score of 10.0, unauthenticated remote code execution (RCE), and widespread impact across React 19, Next.js 15/16, and any framework implementing React Server Components (RSC), this is a vulnerability no one can afford to ignore.

1. Technical Breakdown: The Achilles’ Heel of React Server Components

To fully grasp the issue, let's dive into how RSC (React Server Components) moves data:

The “Flight” Protocol and Serialization

• Server → Client: Component trees are serialized and streamed.
• Client → Server: Server Actions send serialized parameters back to the server.

The Fatal Problem: Unsafe Deserialization

The root cause of the vulnerability lies in how react-server and its adapters (e.g., react-server-dom-webpack) handle incoming requests.

What Went Wrong?

• The server trusts the structure of the serialized payload sent from the client.
• A malicious actor can craft a malformed RSC Flight payload.
• When parsed, this payload abuses React’s internal object restoration logic.
• The server ends up restoring malicious data as executable functions, leading to arbitrary JavaScript execution within the server process.

In short: This is a classic unsafe deserialization vulnerability, amplified by the complexity of RSC and its deep integration across frameworks.

2. Impact Assessment: Who’s in the Blast Radius?

Affected Versions

This vulnerability impacts the following versions:

React Versions:

• 19.0.0
• 19.0.1 (early builds did not fully patch)
• 19.1.x
• 19.2.0

Affected Next.js Versions (App Router):
Due to deep RSC integration, the following Next.js releases are vulnerable:

• 15.0.0–15.0.4
• 15.1.0–15.1.8
• 15.2.x–15.5.6
• 16.0.0–16.0.6
• Canary 14.3.0–canary.77 and later

Other Frameworks:

• Waku
• RedwoodJS (RSC mode)
• Any custom system using react-server-dom-webpack or react-server-dom-*
• Only the old Pages Router (Client Components only) is unaffected.

3. Official Fixes: Upgrade Immediately

Both the React team and Vercel have pushed out patched builds. Here’s how to upgrade:

For Next.js:

• Next.js v16:

  npm install next@16.0.7
  

• Next.js v15:

  npm install next@15.5.7
  

  (Alternatively, you can also install these versions: 15.4.8, 15.3.6, 15.2.6, 15.1.9, 15.0.5)

For React / Custom Integrations:

• npm install react@19.2.1 react-dom@19.2.1
  

Official secure versions include:

• 19.0.1, 19.1.2, 19.2.1

4. Temporary Mitigation: WAF-Level Defense

If you're unable to deploy application code immediately (due to a freeze period, enterprise CI restrictions, etc.), you can temporarily rely on network-layer protection.

Major Cloud Providers

• Cloudflare and AWS have already updated their managed WAF rule sets to block malformed Flight protocol payloads targeting RSC endpoints.

Manual Rules

You can temporarily block suspicious POST requests hitting RSC-related routes:

• Abnormal Content-Type
• Excessively long payloads
• Uncommon Flight packet structures

Warning: This approach might cause false positives, so apply cautiously.

Additional Note: SafeLine WAF

If you’re using SafeLine WAF, its anomaly-detection engine is already effective at identifying non-standard serialization payloads and malformed RSC request patterns. It provides a helpful buffer until you can deploy the official patch.

Important: Always patch as soon as possible. WAFs help mitigate, but they are not a replacement for updates.

5. The Bigger Picture: The Cost of Going “Full-Stack”

In their disclosure, the React team openly acknowledged a growing truth:

As React blurs the boundary between frontend and backend, its security model becomes exponentially more complex.

While Server Actions make full-stack development feel magical—writing SQL inside a component, calling it like a function, and skipping building REST endpoints—this convenience comes with significant risk:

• More server logic becomes reachable via the browser.
• RSC introduces a highly dynamic, complex serialization layer.
• Any flaw in validation or deserialization becomes catastrophic.

CVE‑2025‑55182 is not just a bug. It’s a warning about the direction of modern full-stack frameworks—convenience stretching the attack surface wider than ever.

6. What Should You Do Now?

If your stack involves React 19 or Next.js 15/16, this is a drop-everything moment. Here’s what you need to do:

1. Patch now — upgrade to the secure versions of React and Next.js immediately.
2. Deploy now — don’t wait for a "better time."
3. Audit your RSC endpoints and review your CI/CD pipeline to ensure that they are properly secured.

Conclusion: A Wake-Up Call for the Community

While modern frameworks like React and Next.js have revolutionized full-stack development, CVE-2025-55182 serves as a wake-up call. It underscores the importance of continuously reviewing the security model of our tools as they evolve. The shift to full-stack development is exciting, but it brings significant risks that need to be carefully managed.

As a community, it’s time to rethink how much trust we place in invisible full-stack abstractions. Going forward, let’s prioritize security just as much as convenience in our stack decisions.