Technical Tip: How does Lacework FortiCNAPP Protect from CVE-2025-55182 & CVE-2025-66478, React & NextJS Remote Code Execution Vulnerability
| Description | This article describes a Remote Code Execution (RCE) vulnerability in React (CVE-2025-55182) and Next.js (CVE-2025-66478) that allows an unauthenticated attacker to craft a malicious HTTP request to achieve remote code execution. The vulnerability was first reported by React on December 3rd, 2025.
The vulnerability primarily exists in the react-server component, which is used by React and NextJS. The React Server components allow for the React client to call functions on the server to facilitate functionality such as chunk-loading and server-side rendering (SSR).
The vulnerability allows an unauthenticated attacker to craft a malicious HTTP request to any React Server endpoint, which is then deserialized by React to achieve remote code execution. |
| Scope | Affected Versions: NextJS Versions:
React Versions:
React Packages: Attack Vector: An unauthenticated, malicious HTTP request. Potential Impact: Remote Code Execution.
In-depth information can be found at React.Dev Blog - Critical Security Vulnerability in React Server Components. |
| Solution | Lacework FortiCNAPP automatically detects affected packages found in user environments via the Vulnerability Management Component and Code Security Component. FortiCNAPP will also detect Potentially Compromised Hosts via Composite Alerts and Polygraph
To mitigate this vulnerability, users of affected packages should immediately update to patched versions.
NextJS Mitigation:
React Mitigation:
Note: React and React-dom are not vulnerable, but must be updated alongside react-server-dom-* packages. |
