Responding to CVE-2025-55182: Secure your React and Next.js workloads

Editor’s note : This blog was updated on Dec. 4, 5, 7, and 12, 2025, with additional guidance on Cloud Armor WAF rule syntax, and WAF enforcement across App Engine Standard, Cloud Functions, and Cloud Run. Earlier today, Meta and Vercel publicly disclosed two vulnerabilities that expose services built using the popular open-source frameworks React Server Components ( CVE-2025-55182 ) and Next.js to remote code execution risks when used for some server-side use cases.