React2Shell is the name for CVE-2025-55182, an unauthenticated remote code execution flaw in React Server Components disclosed on December 3, 2025 with a CVSS score of 10.0. React decodes the payloads sent to Server Function endpoints, and a crafted request could make that deserialization run attacker code on the server. It affected react-server-dom-webpack, -parcel and -turbopack 19.0 to 19.2.0 and frameworks built on them, most visibly Next.js. Fixed in React 19.0.1, 19.1.2 and 19.2.1; CISA added it to the KEV catalog on December 5, 2025.
What React2Shell is
React Server Components (RSC) let part of a React app run on the server. The browser talks to the server through Server Functions, sending arguments in React's own serialization format (often called the Flight protocol), and React rebuilds them into values on the server.
React2Shell is an insecure deserialization flaw in that decoding step. An unauthenticated attacker could craft an HTTP request to any Server Function endpoint that, when React deserialized it, achieved remote code execution. The React team noted that apps which define no Server Functions could still be vulnerable if they supported React Server Components at all.
- Affected packages:
react-server-dom-webpack,react-server-dom-parcelandreact-server-dom-turbopack19.0, 19.1.0, 19.1.1 and 19.2.0. - Affected frameworks: Next.js App Router, React Router RSC, Waku, the Parcel and Vite RSC plugins and RedwoodSDK.
- Not affected: apps with no server-side React, such as client-only single-page apps.
Next.js was briefly assigned its own CVE, CVE-2025-66478, which NVD later rejected as a duplicate.
How the attack worked
Shown for defensive context, the attack needed only network access to the app:
- One POST request to a Next.js route that accepts Server Function calls, recognizable by the
Next-Actionheader and a multipart or text body in React's serialization format. - A crafted payload whose structure abuses how references are resolved during deserialization, steering the server into executing attacker-chosen JavaScript in the Node.js process.
- No login, no user interaction. The vulnerable code runs before any application logic checks who is calling.
Public exploits appeared within days of the advisory and mass scanning followed. CISA added the CVE to its Known Exploited Vulnerabilities catalog on December 5, 2025, two days after disclosure. Follow-up fixes in December 2025 and January 2026 addressed related denial-of-service bugs (CVE-2025-55184, CVE-2025-67779, CVE-2026-23864) and a source-code exposure bug (CVE-2025-55183), so "patched for React2Shell" is not the same as current.
How to fix and defend
Upgrade to a release that includes every RSC fix, not just the first one:
- React RSC packages: at least 19.0.1, 19.1.2 or 19.2.1 for CVE-2025-55182, and preferably the latest patch release in your line, which also covers the follow-up denial-of-service and source-exposure bugs.
- Next.js: the latest patch release in your minor line. The official Next.js and React advisories list the exact versions per line.
- Rotate secrets on any app that ran a vulnerable version while exposed to the internet, since code execution in the Node.js process exposes environment variables and cloud credentials.
- Hunt for unexpected child processes from the Node.js server, outbound connections to unknown hosts and new files in writable directories.
Edge rules that inspect Next-Action requests helped during the patch window, but researchers found bypasses quickly. The upgrade is the fix.
References
- [1]React: Critical security vulnerability in React Server Components(React)
- [2]Next.js: CVE-2025-66478 advisory(Next.js)
- [3]NVD: CVE-2025-55182(NIST NVD)
- [4]MITRE CWE-502: Deserialization of Untrusted Data(MITRE)
- [5]CISA Known Exploited Vulnerabilities Catalog(CISA)