Critical Security Vulnerability in React Server Components 3 December 2025

[beevabeeva]

Hi there,

I noticed reactR is using react version 18.2.0

The vulnerability CVE-2025-55182 is

present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of:

[react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
[react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
[react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)

I am not sure if this means previous versions also contain the vulnerability.

We would be very grateful if you could advise if we should take action to remove reactR and all packages depending on it from our software as it is being used in production.

Thank you.