React Server Components deserialization flaw enables remote code execution
Critical deserialization vulnerability in React Server Components (CVE-2025-55182) enables remote code execution, actively exploited in Japan; additional DoS and source code exposure flaws identified.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-55182 as exploited in the wild.
Japan's IPA has issued an alert regarding multiple critical vulnerabilities in React Server Components, a server-side feature of the React JavaScript library. The primary concern is CVE-2025-55182, an untrusted data deserialization vulnerability that allows remote attackers to execute arbitrary code. This vulnerability also affects other products built on React Server Components, including Next.js.
As of December 10, 2025, active exploitation of CVE-2025-55182 has been observed in Japan, prompting urgent warnings for immediate patching. The threat landscape expanded on December 12 when additional vulnerabilities were disclosed: CVE-2025-55184 and CVE-2025-67779 (denial of service), and CVE-2025-55183 (source code exposure). Organizations are advised to update to patched versions immediately.
The alert emphasizes the potential for widespread exploitation given the popularity of React and Next.js in web applications. IPA recommends consulting vendor advisories for specific patching guidance and warns that attack activity may escalate rapidly.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Node.js Server Process (Windows)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell or scripting interpreter being spawned from a Node.js process, consistent with post-exploitation of the React Server Components deserialization RCE (CVE-2025-55182). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Node.js Server Process (Windows)
id: b07919c9-44ff-536d-84cc-6ea0100ebdb0
status: experimental
description: 'Detects command interpreters or scripting engines spawned as children
of node.exe.
This pattern is consistent with exploitation of the CVE-2025-55182 React Server
Components deserialization vulnerability leading to arbitrary code execution on
a Next.js/React SSR host.
'
references:
- IPA advisory on CVE-2025-55182 React Server Components deserialization RCE
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \node.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
filter:
CommandLine|contains:
- npm run
- npm install
- yarn install
- node_modules\.bin
- next build
- next dev
condition: selection and not filter
falsepositives:
- Legitimate build/CI pipelines invoking npm/yarn scripts through node.exe
- Developer tooling that shells out during local Next.js development
level: high
Node.js Process Spawning Shell With Download Utility (Linux)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Node.js server process spawning a shell that invokes curl/wget, a common download-and-execute pattern following RCE exploitation such as CVE-2025-55182 against Next.js/React Server Components. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Process Spawning Shell With Download Utility (Linux)
id: 9e7eba26-63ff-5cbf-917b-b7977aa7e1ef
status: experimental
description: 'Detects node processes (typical of Next.js/React Server Components deployments)
spawning a shell that in turn invokes curl or wget, indicative of a
download-and-execute step after successful exploitation of the CVE-2025-55182
deserialization RCE.
'
references:
- IPA advisory on CVE-2025-55182 React Server Components deserialization RCE
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /node
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_download:
CommandLine|contains:
- 'curl '
- 'wget '
condition: selection_parent and selection_shell and selection_download
falsepositives:
- Container entrypoint or startup scripts that legitimately fetch assets via curl/wget
from a node-managed process
- CI/CD build agents running Next.js build steps that download dependencies
level: high
Node.js Server Process Spawning Reverse Shell Network Connection
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects outbound network connections initiated directly by a node.exe/node process to non-standard high ports, consistent with a reverse shell established after RCE via React Server Components deserialization. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Server Process Spawning Reverse Shell Network Connection
id: b7acd379-f2a3-5e85-aa6e-a9e9168b2241
status: experimental
description: 'Detects a node process making an outbound network connection to a high
or
non-standard destination port shortly after handling requests, which can
indicate a reverse shell or C2 callback following successful exploitation
of the CVE-2025-55182 React Server Components deserialization RCE.
'
references:
- IPA advisory on CVE-2025-55182 React Server Components deserialization RCE
author: Vorant
tags:
- attack.t1203
- attack.command-and-control
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \node.exe
Initiated: 'true'
DestinationPort:
- 4444
- 1337
- 8443
- 9001
filter:
DestinationPort:
- 443
- 80
condition: selection and not filter
falsepositives:
- Internal microservice-to-microservice calls on non-standard ports from a Next.js
SSR host
- Development or debugging tools attached to node.exe on custom ports
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/alert20251209.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs