VDB
BDU%3A2025-15156
BDU%3A2025-15156
PUBLISHED
CVSS 10 CRITICAL
Уязвимость функции requireModule() пакетов react-server-dom-webpack, react-server-dom-parcel и react-server-dom-turbopack JavaScript библиотеки построения пользовательских интерфейсов React, позволяющая нарушителю выполнить произвольный код
Risk Scores
CVSS 2.0
10
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Meta Platforms Inc, Vercel, Сообщество свободного программного обеспечения, The Vac Research Collective, Expo Software, Inc., RedwoodJS Core Team | react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack, Next.js, React Router, Waku, React, Expo, Redwood SDK |
Timeline
- Jun 24, 2024 PoC Published
- Dec 4, 2025 CVE Published
- Dec 4, 2025 PoC Published
- Dec 5, 2025 PoC Published
- Dec 5, 2025 PoC Published
- Dec 6, 2025 PoC Published
- Dec 8, 2025 CVE Updated
- Dec 9, 2025 PoC Published
- Dec 9, 2025 PoC Published
- May 29, 2026 PoC Published
References
- https://github.com/Ashwesker/Blackash-CVE-2025-55182 url
- https://github.com/sickwell/CVE-2025-55182 url
- https://github.com/ejpir/CVE-2025-55182-poc url
- https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv url
- https://react.dev/versions#react-19 url
- https://nextjs.org/blog/CVE-2025-66478 url
- https://github.com/fatguru/CVE-2025-55182-scanner url
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components advisory