Back to insights

Security Advisory: React Server Components CVE‑2025‑55182 No impact on Y Soft SAFEQ Cloud or SAFEQ

Dec 10, 2025

Due to the increasing number of questions from partners and customers regarding CVE‑2025‑55182, we are publishing no impact announcement so you can communicate it further and reassure stakeholders. Overview

On December 3, 2025, the React team disclosed a critical remote code execution vulnerability (CVE‑2025‑55182) affecting React Server Components (RSC) packages. The issue enables unauthenticated RCE via unsafe deserialization in the “Flight” protocol. Patches are available in React 19.0.1 / 19.1.2 / 19.2.1. React advisory and fix information; see also corroborating advisories from CERT‑EU and independent security sources CERT‑EU.

Impact:

Y Soft has investigated these vulnerabilities and services, and determined that it is not impacted.

Helpful links:

  • CVE-2025-55182 - (A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0)

Latest insights

All in Insights

Y Soft Opens Vulnerability Reporting Channel Under the EU Cyber Resilience Act

From 11th September 2026, anyone — you, your customers, or independent security researchers — can report a suspected vulnerability in a Y Soft product directly to us. It's part of our response to the EU Cyber Resilience Act (CRA), in force since 11th September 2026: Y Soft must now report actively exploited vulnerabilities to ENISA within 24 hours, and file a full report within 72. We built the process to meet that deadline — and opened it to everyone, not just regulators.
Sep 22, 2026
News Announcement

SAFEQ Cloud attains SOC 2 Type II certification,

YSoft SAFEQ Cloud attains SOC 2 Type II certification, confirming its internal security controls meet AICPA standards and are robust, consistently effective, and proven in real-world operation. TEXT:
Jun 11, 2026
News Announcement