Critical Security Vulnerability in React Server Components

React disclosed a critical CVSS 10.0 remote code execution vulnerability (CVE-2025-55182) in React Server Components. The vulnerability affects React versions 19.0, 19.1.0, 19.1.1, and 19.2.0, exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Attackers can craft malicious HTTP requests that result in RCE when deserialized. Applications may be vulnerable even if they don't intentionally expose React Server Function endpoints, as affected packages can be pulled in indirectly through frameworks, bundlers, or plugins. The React team is advising immediate upgrades to patched versions.