A website can look unchanged while a server dependency creates a serious exposure behind it. React’s December 3 disclosure describes an unauthenticated remote code execution vulnerability in React Server Components. For teams using the affected packages, the immediate issue is finding the deployed dependency and applying the relevant fix, even when nobody remembers adding that package directly.
The official security advisory identifies CVE-2025-55182 and names three packages: react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack. It lists affected releases in the React 19 family. This is more specific than saying that every website built with React is vulnerable.
The framework can carry the dependency
A team may recognize the name of its application framework without knowing every package that framework deploys. Server Components support can arrive through that toolchain. Searching only for a direct dependency in the application’s top-level package list may therefore miss the relevant code.
The React team makes the boundary explicit: an application whose React code does not use a server is not affected by this vulnerability. It also excludes applications that do not use a framework, bundler or bundler plugin supporting React Server Components. Those distinctions help narrow the investigation, but they need to be established from the actual application.
A sensible inventory includes the package lockfile and the built artifact running in production. Updating a development machine does not establish that a deployed container or a separate preview environment received the same change. The release process has to carry the fix all the way through.
A patch needs a deployment record
The December 3 advisory identifies fixes for the affected release lines and recommends upgrading immediately. React’s disclosure page is the place to follow the framework-specific instructions and subsequent guidance. Historical version lists should not substitute for the current advisory when maintaining a live system.
For the team responsible for a product, useful evidence is straightforward: which applications were checked, which packages were present and which build was deployed afterward. A successful page load is helpful, but does not by itself show that the vulnerable server package has gone.
There is a broader maintenance lesson here. Product teams need a way to answer dependency questions without reconstructing their entire stack during an incident. Our Software coverage treats that visibility as part of running an application, rather than a concern reserved for security specialists.
Reporting & Sources
This account covers the initial December 3, 2025 disclosure in the React security advisory and React team’s explanation. Later additions to the living disclosure page are not treated as facts known at the initial announcement.
