React Server Components received a critical unauthenticated RCE fix.
What happened. The React team disclosed CVE-2025-55182, affecting several React Server DOM packages in versions 19.0, 19.1.0, 19.1.1 and 19.2.0. Patched versions were published with the advisory.
Impact and confidence
The affected package versions and impact are confirmed by the project. A React user interface by itself was not enough to establish exposure; server-component support and deployed dependency versions mattered.
Defensive takeaway
Check production dependency trees and framework guidance, then verify the deployed artifact uses a fixed package—not merely that a lockfile changed.