Meta React Server Components contains a critical remote code execution vulnerability (CVE-2025-55182) that allows unauthenticated attackers to execute arbitrary code remotely. The vulnerability stems from a flaw in how React decodes payloads sent to React Server Function endpoints. This is a high-severity security issue that could lead to complete system compromise without requiring authentication. The vulnerability affects React Server Components and has been acknowledged by both CISA and the React development team.