Documented CVEs
1 vulnerabilities cataloged in the Hermes intelligence repository.
React & React Server Components — Security Intelligence & Vulnerability Profile
1. Software Identity & Security Posture
Section titled “1. Software Identity & Security Posture”| Parameter | Technical Specification |
|---|---|
| Official Name | React & React Server Components |
| Vendor / Project | meta |
| Canonical ID | meta:react |
| Versioning Scheme | semver |
| CPE Identifiers | cpe:2.3:a:meta:react:*:*:*:*:*:*:*:*cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:* |
| Overall Posture | CRITICAL |
| Recommended Safe Release | 19.2.1 |
CISA KEV Entries
1 flaws with confirmed active in-the-wild exploitation.
Weaponized Exploits
1 vulnerabilities with publicly available PoCs or weaponized exploit tooling.
Remediation Target
Recommended upgrade to 19.2.1 to neutralize known flaws.
2. 30-Day Risk Trajectory & Trend Evolution
Section titled “2. 30-Day Risk Trajectory & Trend Evolution”Progression of Hermes Threat Score (HTS) posture and maximum EPSS probability over the last 30 days:
Current HTS Score
0 / 100
= Stable over 30d
Max EPSS (Exploitation)
99.8 %
= Stable over 30d
CISA KEV Activity
1
Active in-the-wild exploitation
HTS Trend Curve (D-30 → Today)2026-08-12 → 2026-09-10
3. Vulnerability History & Version Applicability Matrix
Section titled “3. Vulnerability History & Version Applicability Matrix”| CVE | CVSS Score | EPSS Probability | CISA KEV | Affected Versions | Fixed In | Hermes Analysis |
|---|---|---|---|---|---|---|
| CVE-2025-55182 | 10 (CRITICAL) | 99.8% | CISA KEV | < v19.0.1, < v19.1.2, < v19.2.1 | 19.0.1, 19.1.2, 19.2.1 | Analysis → |
4. Ransomware & Threat Actor Exposure
Section titled “4. Ransomware & Threat Actor Exposure”Vulnerabilities impacting React & React Server Components are actively leveraged in real-world intrusion campaigns:
- CVE-2025-55182: Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ; https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file ; https://nvd.nist.gov/vuln/detail/CVE-2025-55182 (Read deep dive analysis)
5. Evaluate Running Versions in Interactive Workbench
Section titled “5. Evaluate Running Versions in Interactive Workbench”Are you operating React & React Server Components in your infrastructure? Inspect your running build to evaluate applicability, confidence score, and security deltas:
Launch Software Intelligence Workbench for React & React Server Components Run deterministic in-browser evaluation, calculate HTS threat reduction, and plan your upgrade path.