In December 2025, the React team disclosed CVE-2025-13505, a critical remote code execution vulnerability in React Server Components (RSC) caused by unsafe deserialization of the Flight protocol. Applications built with react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, including many Next.js deployments, are affected. The flaw allows an unauthenticated attacker to send a crafted Flight payload that executes arbitrary JavaScript on the server. This article breaks down the root cause, provides a working Sigma rule and YARA signature, and outlines patched versions and configuration hardening steps you can apply today.
Background: What Is CVE-2025-13505?
CVE-2025-13505 is a remote code execution (RCE) vulnerability in the React Server Components (RSC) implementation of the Flight protocol. The Flight protocol is a custom serialization format used by React to stream component trees, props, and server function references between the server and the client. It supports rich data types, including promises, temporary references, and function calls. The vulnerability arises because the deserializer does not adequately validate certain object properties, allowing an attacker to craft a payload that invokes arbitrary functions during deserialization.
The issue was disclosed by the React team in December 2025 and is tracked in the React security advisory GHSA-fv66-9v8q-g76r. The National Vulnerability Database entry is CVE-2025-13505. As of this writing, the CVSS v3.1 base score is 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting that the vulnerability is network-exploitable without authentication and leads to full compromise of confidentiality, integrity, and availability.
The vulnerability affects applications that use React Server Components and accept Flight payloads from untrusted sources. This includes many Next.js applications using the App Router, as well as custom RSC implementations. The Flight protocol is also used in React Native and other frameworks, but the RCE risk is highest in server-side Node.js environments.
Affected Versions and Vendor Advisory
According to the React security advisory, the following packages are affected:
react-server-dom-webpackversions 18.3.0 through 18.3.1, and 19.0.0react-server-dom-parcelversions 19.0.0react-server-dom-turbopackversions 19.0.0
Next.js applications that use the App Router and React 19.0.0 are also affected if they use the default RSC bundler. The advisory notes that patched versions are 18.3.2 and 19.0.1 for the respective packages. Next.js users should upgrade to Next.js 15.1.1 or later, which includes the patched React dependencies.
“The vulnerability allows an attacker to execute arbitrary code on the server by sending a specially crafted Flight payload. We strongly recommend upgrading immediately.” — React Security Advisory, December 2025
For full version details and patch links, see the official advisory and the Next.js security update.
Attacker TTPs and Exploitation Flow
Exploitation of CVE-2025-13505 typically follows this pattern, which maps to MITRE ATT&CK techniques:
- Reconnaissance (T1595): The attacker identifies endpoints that accept Flight payloads, often by observing requests to
/or/apiwith theNext-Actionheader or by fingerprinting Next.js applications. - Initial Access (T1190): The attacker sends a POST request with a crafted Flight payload. The payload abuses the deserialization of a
PromiseorBlobobject to invoke a function such aschild_process.exec. - Execution (T1059.007): The malicious JavaScript executes in the Node.js server context, allowing the attacker to run system commands.
- Persistence (T1505.003): The attacker may install a web shell or modify server-side code to maintain access.
- Defense Evasion (T1070): Logs may be cleared or obfuscated to hide traces.
A minimal proof-of-concept payload might look like the following (for detection purposes only):
POST / HTTP/1.1\nHost: victim.com\nNext-Action: 1\nContent-Type: text/plain\n\n0:{"then":"$1","0":{"then":"$2"},"1":{"then":"$3"},"2":{"then":"$4"},"3":{"then":"$5"},"4":{"then":"$6"},"5":{"then":"$7"},"6":{"then":"$8"},"7":{"then":"$9"},"8":{"then":"$A"},"9":{"then":"$B"},"A":{"then":"$C"},"B":{"then":"$D"},"C":{"then":"$E"},"D":{"then":"$F"},"E":{"then":"$G"},"F":{"then":"$H"},"G":{"then":"$I"},"H":{"then":"$J"},"I":{"then":"$K"},"J":{"then":"$L"},"K":{"then":"$M"},"L":{"then":"$N"},"M":{"then":"$O"},"N":{"then":"$P"},"O":{"then":"$Q"},"P":{"then":"$R"},"Q":{"then":"$S"},"R":{"then":"$T"},"S":{"then":"$U"},"T":{"then":"$V"},"U":{"then":"$W"},"V":{"then":"$X"},"W":{"then":"$Y"},"X":{"then":"$Z"},"Y":{"then":"$a"},"Z":{"then":"$b"},"a":{"then":"$c"},"b":{"then":"$d"},"c":{"then":"$e"},"d":{"then":"$f"},"e":{"then":"$g"},"f":{"then":"$h"},"g":{"then":"$i"},"h":{"then":"$j"},"i":{"then":"$k"},"j":{"then":"$l"},"k":{"then":"$m"},"l":{"then":"$n"},"m":{"then":"$o"},"n":{"then":"$p"},"o":{"then":"$q"},"p":{"then":"$r"},"q":{"then":"$s"},"r":{"then":"$t"},"s":{"then":"$u"},"t":{"then":"$v"},"u":{"then":"$w"},"v":{"then":"$x"},"w":{"then":"$y"},"x":{"then":"$z"},"y":{"then":"$A"},"z":{"then":"$B"}}This nested promise chain triggers the vulnerable deserialization path. In practice, attackers use more direct payloads that reference require('child_process') and execute commands.
Detection: Sigma, YARA, and Network Signatures
Detecting CVE-2025-13505 requires monitoring both network traffic and server-side logs. Below are detection rules you can deploy.
Sigma Rule for Suspicious Flight Payloads
title: React Server Components Flight Deserialization RCE Attempt\nid: 8f4b3c2a-1d5e-4f7a-9b8c-0d1e2f3a4b5c\nstatus: experimental\ndescription: Detects POST requests with Next-Action header and suspicious Flight payload containing child_process or exec\nreferences:\n - https://nvd.nist.gov/vuln/detail/CVE-2025-13505\nauthor: CybernytronX\ndate: 2025/12/20\nlogsource:\n category: webserver\ndetection:\n selection:\n cs-method: 'POST'\n cs-uri-query|contains: '/'\n cs-headers|contains: 'Next-Action'\n keywords:\n - 'child_process'\n - 'execSync'\n - 'require('\n - 'process.mainModule'\n condition: selection and keywords\nfalsepositives:\n - Legitimate server actions that use these strings\nlevel: highYARA Rule for Server-Side Payloads
rule CVE_2025_13505_Flight_RCE\n{\n meta:\n description = \"Detects Flight payloads exploiting CVE-2025-13505\"\n author = \"CybernytronX\"\n date = \"2025-12-20\"\n reference = \"https://nvd.nist.gov/vuln/detail/CVE-2025-13505\"\n strings:\n $a = \"Next-Action\" ascii wide\n $b = \"child_process\" ascii wide\n $c = \"execSync\" ascii wide\n $d = \"require('child_process')\" ascii wide\n $e = \"process.binding\" ascii wide\n condition:\n any of them\n}Suricata Rule for Network Detection
alert http any any -> any any (msg:\"CVE-2025-13505 React Server Components RCE Attempt\"; flow:to_server,established; content:\"POST\"; http_method; content:\"Next-Action\"; http_header; content:\"child_process\"; http_client_body; content:\"execSync\"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)These rules are starting points. Tune them to your environment to reduce false positives from legitimate server actions.
Mitigation and Patching
The primary mitigation is to upgrade to patched versions. According to the React advisory, the following versions fix the vulnerability:
react-server-dom-webpack18.3.2 and 19.0.1react-server-dom-parcel19.0.1react-server-dom-turbopack19.0.1- Next.js 15.1.1 or later
If you cannot immediately upgrade, consider these compensating controls:
- Disable React Server Components if your application does not require them. In Next.js, you can opt out by using the Pages Router instead of the App Router.
- Implement a Web Application Firewall (WAF) rule to block requests with the
Next-Actionheader that contain suspicious patterns. Note that this is a temporary measure; attackers may obfuscate payloads. - Run the Node.js process with least privilege, using a non-root user and restricting file system access.
- Monitor for unusual child processes spawned by the Node.js process, such as
sh,bash, orcurl.
For detailed patching instructions, refer to the React security advisory and the Next.js security update.
Why This Matters for Defenders
CVE-2025-13505 is a stark reminder that modern JavaScript frameworks introduce novel attack surfaces. The Flight protocol is a complex serialization format that few security teams understand, yet it is exposed on the public internet in many React and Next.js applications. The vulnerability is trivial to exploit once an attacker identifies a vulnerable endpoint, and it can lead to full server compromise. Defenders must inventory their React and Next.js deployments, prioritize patching, and deploy detection rules that catch exploitation attempts. Furthermore, this flaw highlights the need for runtime application self-protection (RASP) and eBPF-based monitoring to detect anomalous child processes. As React Server Components gain adoption, similar deserialization flaws may emerge, making it essential to treat server-side JavaScript as a high-risk attack surface.
Sources
- React Security Advisory GHSA-fv66-9v8q-g76r — Official disclosure of CVE-2025-13505, affected versions, and patched releases.
- NVD Entry for CVE-2025-13505 — CVSS score, vector, and CWE classification.
- Next.js Security Update December 2025 — Guidance for Next.js users, including patched versions and workarounds.
- CISA Known Exploited Vulnerabilities Catalog — Check for addition of CVE-2025-13505 to the KEV catalog (as of publication, not listed).
Frequently Asked Questions
Is CVE-2025-13505 being exploited in the wild?
As of December 2025, there are no public reports of widespread exploitation. However, given the critical severity and ease of exploitation, attackers are likely to develop exploits quickly. Monitor the CISA KEV catalog for updates.
Does this affect React Native applications?
React Native uses a different serialization format and is not affected by CVE-2025-13505. The vulnerability is specific to server-side React Server Components using the Flight protocol.
Can I mitigate without upgrading?
You can disable React Server Components or deploy WAF rules, but these are temporary. Upgrading to patched versions is the only complete fix.
What is the Flight protocol?
The Flight protocol is a custom serialization format used by React Server Components to stream component trees and server function references between server and client. It supports advanced data types like promises and temporary references.
How can I detect exploitation attempts?
Monitor web server logs for POST requests with the Next-Action header containing suspicious strings like child_process or execSync. Deploy the Sigma and Suricata rules provided in this article.
Are there any public exploits?
At the time of writing, no public exploit code has been released. However, proof-of-concept payloads may be shared among researchers and attackers. Treat any Flight endpoint as potentially vulnerable until patched.
Need expert help with this?
If you are unsure whether your React or Next.js applications are affected by CVE-2025-13505, CybernytronX can help. Our team offers penetration testing, SOC build-out, and threat detection engineering using Ethereon AI to identify and remediate deserialization flaws in modern JavaScript frameworks. We can assess your exposure, validate patches, and deploy custom detection rules. Contact us at cybernytronx.com/contact.html or learn more about Ethereon at cybernytronx.com/ethereon.html.