A serious Remote Code Execution vulnerability in React, identified as CVE-2025-55182, affects versions prior to December 2025. It exploits a deserialization flaw in React Server Components, allowing attackers to execute arbitrary code via crafted HTTP requests without authentication. Upgrading to patched versions is essential for security.

Security researchers found new vulnerabilities in React Server Components, including high-severity Denial of Service and medium-severity source code exposure issues. Users are urged to upgrade to fixed versions immediately to mitigate potential exploits.

A critical security flaw in React Server Components allows unauthenticated remote code execution. Users should upgrade to fixed versions immediately to protect their applications from potential attacks.