React2Shell (CVE‑2025‑55182) is a critical security vulnerability affecting the React Server Components (RSC) ecosystem. First disclosed on December 3, 2025, this flaw allows unauthenticated remote attackers to execute arbitrary code on vulnerable servers simply by sending a crafted HTTP request. Because the vulnerability exists in core server‑side deserialization logic, even default React/Next.js configurations are affected, making this one of the most serious issues in the ecosystem with a maximum CVSS severity score of 10.0. :contentReference[oaicite:0]{index=0}

What Is the React2Shell Vulnerability?

React2Shell (CVE‑2025‑55182) is a critical pre‑authentication remote code execution (RCE) flaw rooted in how the React Server Components Flight protocol handles incoming payloads. The server deserializes HTTP request data without sufficient validation, allowing attacker‑controlled input to be processed as legitimate execution logic. This can result in arbitrary server‑side code execution. :contentReference[oaicite:1]{index=1}

Since no authentication or special access is required, attackers only need network access to a reachable RSC endpoint to trigger the flaw, which contributes to its extremely high risk. :contentReference[oaicite:2]{index=2}

Why This Matters

React and frameworks like Next.js are widely used for modern web applications, including commercial sites and enterprise dashboards. Because many default configurations include support for React Server Components, a large portion of the ecosystem was exposed to this vulnerability immediately after disclosure. :contentReference[oaicite:3]{index=3}

• react-server-dom-webpack
• react-server-dom-parcel
• react-server-dom-turbopack

Frameworks and tools that bundle these React Server packages — including Next.js with the App Router — inherit the same vulnerability unless patched. :contentReference[oaicite:4]{index=4}

How React2Shell Can Be Exploited

The vulnerability affects the server‑side logic that deserializes RSC Flight protocol payloads. A specially crafted HTTP POST request can bypass validation and manipulate internal structures, leading to arbitrary JavaScript execution with the server’s privileges. :contentReference[oaicite:5]{index=5}

Successful exploitation may allow attackers to:

✔ Execute arbitrary server‑side code
✔ Deploy malware or cryptominers
✔ Steal environment variables or secrets
✔ Gain persistent access to systems
✔ Compromise backend services or databases

Who Is at Risk?

Any application using affected React Server Components versions is at risk. According to public advisories, versions 19.0.0 through 19.2.0 of key RSC packages are vulnerable. Even servers that appear to use only client‑side code can be affected if server‑side rendering or server functions are enabled. :contentReference[oaicite:6]{index=6}

Attackers have been observed scanning for and attempting exploitation shortly after the vulnerability was disclosed, indicating active threat activity in the wild. :contentReference[oaicite:7]{index=7}

Which Versions Are Affected?

The core vulnerable packages and versions include:

✔ react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack — versions 19.0.0, 19.1.0, 19.1.1, 19.2.0

Patched versions with fixes include:

• React RSC: 19.0.1, 19.1.2, 19.2.1 and above
• Next.js patched versions (e.g., 15.x & 16.x releases with RSC fixes)

It is critical to update these packages and any frameworks that include them to the latest patched releases to close the vulnerability. :contentReference[oaicite:8]{index=8}

How to Protect Your React Apps

Below are essential steps developers should take to defend against React2Shell and similar vulnerabilities:

🔹 1. Update Dependencies

Install the latest patched versions of React Server Components and any frameworks or tools that bundle them. This step closes the unsafe deserialization issue at its source. :contentReference[oaicite:9]{index=9}

🔹 2. Use a Web Application Firewall

Deploy a Web Application Firewall (WAF) to help block malicious or malformed requests targeted at RSC endpoints while you update or review code. :contentReference[oaicite:10]{index=10}

🔹 3. Monitor Logs & Traffic

Regularly review server logs and network traffic for unusual POST requests or other anomalies that may indicate attempted exploitation. :contentReference[oaicite:11]{index=11}

🔹 4. Audit Dependencies

Use tools like npm audit, Snyk, or other vulnerability scanners to find outdated packages and known security issues in your project. :contentReference[oaicite:12]{index=12}

🔹 5. Avoid Unsafe Patterns

Minimize the use of unsafe deserialization patterns and always validate user‑supplied data before using it in server logic. :contentReference[oaicite:13]{index=13}

What Developers Should Learn

React2Shell highlights how insecure server‑side deserialization can lead to critical remote code execution vulnerabilities. It reinforces the importance of strict input validation, regular dependency updates, and proactive security practices for any web application utilizing server‑side features. :contentReference[oaicite:14]{index=14}

---

🔚 Conclusion

React2Shell (CVE‑2025‑55182) is one of the most serious vulnerabilities affecting modern React applications. Because it enables unauthenticated remote code execution and is actively being targeted, developers must update affected packages, apply protective measures like WAF, and monitor application behavior closely to reduce risk. :contentReference[oaicite:15]{index=15}