Security advisory: React Server Components RCE (CVE-2025-55182) — am I affected?

What causes this error

A critical vulnerability was disclosed in the react-server-dom-* packages that power React Server Components' serialization protocol, affecting React versions 19.0.0 through 19.2.2. Exploitation could lead to remote code execution or source-code exposure in applications using RSC, including default framework scaffolds that enable it out of the box.

The Fix

# Check your installed version
npm ls react react-dom

# Upgrade to a patched release
npm install react@latest react-dom@latest

# Patched versions specifically: 19.0.4, 19.1.5, 19.2.4, and later

If your app is purely client-side React with no Server Components involved (no `"use server"`, no RSC-capable framework rendering mode), this specific CVE does not apply — but upgrading is still good practice for the other fixes bundled into later patch releases.

Common causes / variations

• A default framework scaffold (RSC enabled by default) never explicitly upgraded past the vulnerable range
• Pinning an exact React version for stability and missing the patch release cycle
• Confusing this with unrelated hydration/serialization warnings — this is a security advisory, not a typical runtime bug

Related errors

See also: Only plain objects can be passed to Client Components, cache() called outside a request.