Sploitus

3 exploited vulnerabilities in React Server Components

Vulnerabilities with publicly known exploits

Vendors
Meta, Next.Js, Node.Js, Unknown, Red Os, Rocky Linux
With known exploits
3
Affected Facebook React versions
= 19.0.0, 19.1.0, 19.1.1, 19.2.0, 19.0.2, 19.1.3, 19.2.2
Affected Nodejs Node.js versions
< 20.20.0, 22.22.0, 24.13.0, 25.3.0

Vulnerabilities with exploits

Highest CVSS first — 2 of these already have exploit code on Sploitus

CVE-2025-55182 383 exploits
CVSS 10.0 CRITICAL 2025-12-03FIX AVAILABLE
Exploit for Deserialization of Untrusted Data in Facebook Reactreact2shell-poc
CVE-2025-59466
CVSS 7.8 HIGH 2025-01-01FIX AVAILABLE
CVE-2025-55184 10 exploits
CVSS 7.5 HIGH 2025-12-11FIX AVAILABLE
Exploit for Deserialization of Untrusted Data in Facebook ReactExploit for Deserialization of Untrusted Data in Facebook React