Post

A critical RCE vulnerability (CVE-2025-55182) in React Server Components was disclosed on December 3. Bugcrowd has activated its zero-day workflow, formed a dedicated triage group, and is validating submissions.

4/12/25, 4:09 pm0 reposts2 likes

Bugcrowd

@bugcrowd.com

4 Dec 2025

Early signs show meaningful exposure across monitored environments. Read Michael's update and watch the Security Flash for next steps. 📝 www.bugcrowd.com/blog/cve-202...

bugcrowd.comCVE-2025-55182: What you need to know about React2Shell | @BugcrowdOn December 3, 2025, the React Team disclosed a critical remote code execution (RCE) vulnerability affecting React Server Components, commonly used in modern Next.js deployments. An unauthenticated at...