CVE-2025-55182: Verified Repro With Script Download

Vulnerability Summary

CVE: CVE-2025-55182 Product: npm:react-server-dom-webpack (also react-server-dom-parcel, react-server-dom-turbopack) Affected Versions: 19.0.0, 19.1.0-19.1.1, 19.2.0 Fixed Versions: 19.0.1, 19.1.2, 19.2.1 Severity: Critical (CVSS 10.0) Impact: Pre-authentication Remote Code Execution Surface: API Remote (HTTP POST to Server Function endpoint)

Root Cause

The vulnerability exists in the Flight protocol deserialization code of react-server-dom-webpack/server, specifically in the decodeReply() function that processes attacker-controlled multipart/form-data payloads from HTTP requests to Server Function endpoints.

The core flaw is in reference resolution: when the Flight protocol encounters references like $1:property:property, it traverses object properties without checking hasOwnProperty(). This allows an attacker to traverse the JavaScript prototype chain and reach dangerous built-in constructors:

• $1:__proto__:then resolves to Chunk.prototype.then (the real then method on Chunk objects, accessed via the prototype chain)
• $1:constructor:constructor resolves to Function (the JavaScript Function constructor, accessed via Object.constructor.constructor)

Exploit Mechanism

The exploit (based on the public PoC by researcher maple3142) crafts a multipart/form-data body with two form fields:

1. Field "0": A JSON model object containing:

   • then: "$1:__proto__:then" — sets the chunk's then to Chunk.prototype.then via prototype chain traversal
   • status: "resolved_model" — triggers initializeModelChunk() on the fake chunk when it is awaited
   • _response._prefix — the attacker's code string (e.g., process.mainModule.require('child_process').execSync('id'))
   • _response._formData.get: "$1:constructor:constructor" — resolves to the Function constructor via prototype chain

2. Field "1": "$@0" — creates a Chunk reference to field "0"'s value

When decodeReply() processes this FormData:

1. Field "1" ($@0) creates a Chunk reference to field "0"
2. The model object from field "0" is parsed
3. When the chunk is awaited, Chunk.prototype.then runs with the fake model object as this
4. status: "resolved_model" triggers initializeModelChunk()
5. initializeModelChunk() accesses _response._formData.get (which is the Function constructor) with _response._prefix (the code string)
6. new Function(codeString)() executes arbitrary code on the server

A single unauthenticated POST request with a Next-Action header triggers this chain, achieving remote code execution.

Evidence of Reproduction

Vulnerable Version (react-server-dom-webpack@19.2.0)

• Server started: Health check passed (HEALTHY 19.2.0)
• Exploit sent: POST with Next-Action: x header and crafted multipart/form-data body
• RCE confirmed: The id command executed on the server, writing uid=1000(vscode) gid=1000(vscode) groups=1000(vscode),962(962) to a marker file
• Stack trace: Server log shows the code executed via eval at parseModelString in react-server-dom-webpack-server.node.unbundled.development.js

Fixed Version (react-server-dom-webpack@19.2.1) — Negative Control

• Server started: Health check passed (HEALTHY 19.2.1)
• Same exploit sent: Identical POST request
• RCE blocked: decodeReply() completed normally, returning [object Object] without executing any code
• No marker file created: The hasOwnProperty() checks added in the patch prevent prototype chain traversal, blocking the Function constructor access

The Fix

The patch (in versions 19.0.1, 19.1.2, 19.2.1) adds explicit hasOwnProperty() checks before returning values from module export objects during reference resolution. This prevents attacker-controlled keys from resolving inherited prototype properties, blocking the prototype-chain access that enabled the Function constructor gadget.

Additionally, the patch improves multipart payload decoding robustness by adding error handling around field and file processing.

Reproduction Environment

• Node.js: v24.15.0
• OS: Ubuntu 26.04 LTS
• Vulnerable package: react-server-dom-webpack@19.2.0
• Fixed package: react-server-dom-webpack@19.2.1
• Server: Minimal HTTP server calling decodeReply() with --conditions react-server flag
• Exploit: Python client sending the crafted multipart POST

Artifacts

• logs/server_vuln.log — vulnerable server log showing decodeReply call
• logs/server_fixed.log — fixed server log showing normal completion
• repro/artifacts/request_vuln.txt — raw HTTP exploit request
• repro/artifacts/response_vuln.txt — HTTP response (timeout, expected)
• repro/artifacts/request_fixed.txt — same request against fixed version
• repro/artifacts/response_fixed.txt — HTTP 200 with normal result
• repro/artifacts/rce_marker_vuln.txt — id command output proving RCE
• repro/runtime_manifest.json — structured runtime evidence