CVE-2025-55182 – React Server Components RCE via Flight Payl...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.offsec.com/blog/cve-2025-55182/
• Blog Title: CVE-2025-55182 – React Server Components RCE via Flight Payload Deserialization
• Suggested Section: Pentesting Web -> Deserialization (new subsection for React Server Components / Flight payload deserialization RCE) or Pentesting Web -> NodeJS/Express/NextJS with a dedicated 'React Server Components Flight Deserialization RCE (CVE-2025-55182)' section.

🎯 Content Summary

CVE-2025-55182 is a critical unauthenticated Remote Code Execution (RCE) vulnerability (CVSS 10.0) in the React Server Components (RSC) ecosystem, affecting React Server Components packages 19.0, 19.1.0, 19.1.1, and 19.2.0. It affects any environment that uses the affected react-server-dom-* packages, including apps that do not explicitly define server functions, because many frameworks pull these packages transitively.

RSC communicates with the s...

🔧 Technical Details

Abusing React Flight’s Chunk deserialization and thenables for RCE
React Server Components use the Flight protocol to serialize component trees as internal Chunk objects that are resolved as Promises during server-side parsing. In vulnerable RSC versions, the server does not validate that incoming objects are genuine Chunks and deserializes arbitrary user-supplied structures from the request body. An attacker can send a malicious object shaped like a Chunk that includes a then property (making it a thenable). When React’s Flight logic processes this Chunk, it invokes the attacker’s then handler as part of Promise resolution, giving the attacker access to internal state such as the _response object and enabling manipulation of how subsequent data is interpreted and executed.

Turning internal RSC gadgets into an RCE primitive via constructor.constructor
Once the attacker has influence over internal gadgets...

🤖 Agent Actions

Summary:

• Added a detailed “React Server Components Flight Payload Deserialization RCE (CVE-2025-55182)” section to src/pentesting-web/deserialization/README.md, covering the vulnerable RSC versions, exploitation chain (thenable Chunk abuse, _response gadgeting, Function constructor reach), and practical steps for crafting multipart Flight payloads.
• Included an expandable PoC request plus concrete detection and mitigation guidance tailored to Flight traffic and RSC environments.
• Updated the references section to cite the OffSec blog post that documents CVE-2025-55182.

Testing:

• Not run (documentation-only changes).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.offsec.com/blog/cve-2025-55182/

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> Deserialization (new subsection for React Server Components / Flight payload deserialization RCE) or Pentesting Web -> NodeJS/Express/NextJS with a dedicated 'React Server Components Flight Deserialization RCE (CVE-2025-55182)' section.".

Repository Maintenance:

• MD Files Formatting: 914 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0