⚠️ Critical Security Alert: React Server Components Vulnerability Disclosed
A critical security vulnerability has been disclosed in React Server Components (CVE-2025-55182), impacting React 19 and frameworks built on top of it, including Next.js (CVE-2025-66478). If your project runs on React 19 or Next.js, you need to act now.
What Is the Vulnerability?
This issue allows unauthenticated attackers to craft malicious HTTP requests that could lead to remote code execution (RCE) via insecure deserialization in the RSC “Flight” protocol — the underlying mechanism React uses to stream server component data to the client.
In plain terms: an attacker could send a specially crafted request to your server and potentially execute arbitrary code without needing any credentials. This is as serious as it gets.
Who Is Affected?
- Any application running React 19 (prior to 19.2.3)
- Any application running Next.js (prior to 15.4.10)
- Payload CMS projects using affected versions of React or Next.js (Payload itself is not vulnerable, but projects built on it may be)
- Any other framework or library built on top of React Server Components
How to Patch — Act Now
The fix is straightforward. Update your dependencies immediately:
# Update React to the patched version
npm install react@19.2.3 react-dom@19.2.3
# Update Next.js to the patched version
npm install next@15.4.10
# Then reinstall all dependencies
npm installOr if you use pnpm:
pnpm add react@19.2.3 react-dom@19.2.3 next@15.4.10
pnpm installOr yarn:
yarn add react@19.2.3 react-dom@19.2.3 next@15.4.10
yarn installPayload CMS Users
Payload CMS has confirmed this is not a Payload vulnerability, but any Payload project running on affected versions of React or Next.js is at risk. The Payload team has already issued a fix in their repository:
- See the related fix: payloadcms/payload#14807
- Payload CMS v3.80.0 (released March 20, 2026) also resolves high severity audit vulnerabilities
Key Takeaways
- ✅ Severity: Critical — Remote Code Execution possible
- ✅ Attack vector: Unauthenticated HTTP requests
- ✅ Affected: React 19 < 19.2.3, Next.js < 15.4.10
- ✅ Fix: Update React to 19.2.3 and Next.js to 15.4.10
- ✅ Payload CMS: Not directly vulnerable, but update your project dependencies
Don’t wait — update your projects today. Security vulnerabilities of this severity are actively targeted by malicious actors shortly after disclosure.
Hashtags: #ReactJS #NextJS #WebSecurity #CVE #RemoteCodeExecution #PayloadCMS #WebDevelopment #SecurityAlert #JavaScript #OpenSource
Sources & References: