VORANT. Threat Intelligence Sign in Get the full feed

Critical deserialization vulnerability in React Server Components (CVE-2025-55182)…

critical vulnerability technology

Critical deserialization vulnerability in React Server Components (CVE-2025-55182) enables remote code execution, actively exploited in Japan; additional DoS and source code exposure flaws identified.

Japan's IPA has issued an alert regarding multiple critical vulnerabilities in React Server Components, a server-side feature of the React JavaScript library. The primary concern is CVE-2025-55182, an untrusted data deserialization vulnerability that allows remote attackers to execute arbitrary code. This vulnerability also affects other products built on React Server Components, including Next.js.

As of December 10, 2025, active exploitation of CVE-2025-55182 has been observed in Japan, prompting urgent warnings for immediate patching. The threat landscape expanded on December 12 when additional vulnerabilities were disclosed: CVE-2025-55184 and CVE-2025-67779 (denial of service), and CVE-2025-55183 (source code exposure). Organizations are advised to update to patched versions immediately.

The alert emphasizes the potential for widespread exploitation given the popularity of React and Next.js in web applications. IPA recommends consulting vendor advisories for specific patching guidance and warns that attack activity may escalate rapidly.

Mentioned in this report

Vulnerabilities CVE-2025-55182KEVCVE-2025-55183CVE-2025-55184templatedCVE-2025-67779

Detection guidance

Suspicious Child Process Spawned by Node.js Server Process (Windows)

ATT&CK T1203

Detects a shell or scripting interpreter being spawned from a Node.js process, consistent with post-exploitation of the React Server Components deserialization RCE (CVE-2025-55182). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned by Node.js Server Process (Windows)
id: b07919c9-44ff-536d-84cc-6ea0100ebdb0
status: experimental
description: 'Detects command interpreters or scripting engines spawned as children
  of node.exe.

  This pattern is consistent with exploitation of the CVE-2025-55182 React Server

  Components deserialization vulnerability leading to arbitrary code execution on

  a Next.js/React SSR host.

  '
references:
- IPA advisory on CVE-2025-55182 React Server Components deserialization RCE
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \node.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
  filter:
    CommandLine|contains:
    - npm run
    - npm install
    - yarn install
    - node_modules\.bin
    - next build
    - next dev
  condition: selection and not filter
falsepositives:
- Legitimate build/CI pipelines invoking npm/yarn scripts through node.exe
- Developer tooling that shells out during local Next.js development
level: high

Node.js Process Spawning Shell With Download Utility (Linux)

ATT&CK T1203

Detects a Node.js server process spawning a shell that invokes curl/wget, a common download-and-execute pattern following RCE exploitation such as CVE-2025-55182 against Next.js/React Server Components. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Node.js Process Spawning Shell With Download Utility (Linux)
id: 9e7eba26-63ff-5cbf-917b-b7977aa7e1ef
status: experimental
description: 'Detects node processes (typical of Next.js/React Server Components deployments)

  spawning a shell that in turn invokes curl or wget, indicative of a

  download-and-execute step after successful exploitation of the CVE-2025-55182

  deserialization RCE.

  '
references:
- IPA advisory on CVE-2025-55182 React Server Components deserialization RCE
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /node
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_download:
    CommandLine|contains:
    - 'curl '
    - 'wget '
  condition: selection_parent and selection_shell and selection_download
falsepositives:
- Container entrypoint or startup scripts that legitimately fetch assets via curl/wget
  from a node-managed process
- CI/CD build agents running Next.js build steps that download dependencies
level: high

Node.js Server Process Spawning Reverse Shell Network Connection

ATT&CK T1203

Detects outbound network connections initiated directly by a node.exe/node process to non-standard high ports, consistent with a reverse shell established after RCE via React Server Components deserialization. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Node.js Server Process Spawning Reverse Shell Network Connection
id: b7acd379-f2a3-5e85-aa6e-a9e9168b2241
status: experimental
description: 'Detects a node process making an outbound network connection to a high
  or

  non-standard destination port shortly after handling requests, which can

  indicate a reverse shell or C2 callback following successful exploitation

  of the CVE-2025-55182 React Server Components deserialization RCE.

  '
references:
- IPA advisory on CVE-2025-55182 React Server Components deserialization RCE
author: Vorant
tags:
- attack.t1203
- attack.command-and-control
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \node.exe
    Initiated: 'true'
    DestinationPort:
    - 4444
    - 1337
    - 8443
    - 9001
  filter:
    DestinationPort:
    - 443
    - 80
  condition: selection and not filter
falsepositives:
- Internal microservice-to-microservice calls on non-standard ports from a Next.js
  SSR host
- Development or debugging tools attached to node.exe on custom ports
level: medium

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/alert20251209.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free