cve-2025-55182-mitigator

Defensive scanner + mitigation guidance for CVE-2025-55182 (React Server Components / Flight protocol insecure deserialization).

This tool is intended to help you:

• identify repos that are likely vulnerable based on dependency versions
• quickly apply the definitive mitigation (patch/upgrade) targets

Important

• Immediate patching is the only definitive mitigation.
• This tool cannot prove exploitability. It uses version heuristics plus repo signals.
• If you suspect compromise, follow your incident response process.

Upgrade targets (definitive mitigation)

From December 2025 guidance:

• React: 19.0.1 or 19.1.2 or 19.2.1
• Next.js: 16.0.7 or 15.5.7 or 15.4.8 or 15.3.6 or 15.2.6 or 15.1.9 or 15.0.5

Install

From this repo:

npm install

Run via Node:

node cli.js scan .

Or install globally:

npm install -g .
cve-2025-55182 scan .

Usage

Scan a repository

cve-2025-55182 scan /path/to/repo

JSON output:

cve-2025-55182 scan /path/to/repo --json

CI-friendly exit code:

cve-2025-55182 scan /path/to/repo --fail-on-vulnerable

• exits 2 if likely vulnerable
• exits 0 if not flagged
• exits 1 on errors

Print mitigation targets

cve-2025-55182 help-mitigate

Generate optional hardening snippets

These are not a substitute for patching.

cve-2025-55182 generate --express
cve-2025-55182 generate --nginx

What it checks

• package.json dependency ranges for next, react, react-dom, react-server
• lockfiles to find resolved versions:
  • package-lock.json
  • pnpm-lock.yaml
  • yarn.lock

License

MIT