Critical vulnerability allows remote code execution on servers that use React Server components. Learn how to protect your app.
December 5, 2025
•
,
3 minutes to read
Critical vulnerabilities (CVSS 10) affecting React and Next.js that allow RCE (Remote Unauthenticated Code Execution) have been discovered.
Applications that use React Server Components (RSC) can be at risk even without exposed server function endpoints.
Update: Active use of React2Shell
AWS has warned that the React2Shell vulnerability (CVE-2025-55182) is already being used in attacks by groups linked to China. Exploitation began within hours of the public disclosure and attempts against applications in critical sectors such as finance, retail and government were detected. Additionally, there is a proof of concept on GitHub, which increases the risk of mass attacks.
Popularity and possible influence
These technologies are very popular (React has 55.8 million weekly downloads on NPM), and according to information collected by Wiz Research, 39% of cloud environments contain vulnerable instances of React and Next.js affected by these critical flaws (CVE-2025-55182 and CVE-2025-66478).
This means that teams developing applications with these frameworks must act immediately to avoid compromises in production.
Impact on industry
Popular services that rely on React and Next.js, such as e-commerce platforms, social networks, banking applications, productivity tools, and streaming sites, could be at risk if the patches are not applied. This means that an attacker could compromise the servers that host widely used applications, affecting the availability, integrity and privacy of millions of users.
Even if your application doesn’t implement React Server feature endpoints, it can be vulnerable if it supports React Server components.
As a disadvantage can be used
The problem reported by Lachlan Davidson is caused by unsafe deserialization: the server does not properly validate the structure of the data it receives. This allows an attacker to send a malformed HTTP request and execute privileged JavaScript code on the server.
In particular, the problem arises when decoding the payloads of the Flight RSC protocol, which opens the door for RCE.
Affected React packages and versions:
Affects default configurations in react-server-dom-* packages and in Next.js App Router; Even applications that do not expose server functions can be vulnerable if they support RSC.
Respond:
- Paquetes: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack.
- Versions: 19.0, 19.1.0, 19.1.1 and 19.2.0.
Next.js:
- With 14.3.0-canary.77 and all 15.x and 16.x branches before the patch.
Other projects that may be affected:
- Vite RSC Plugin, Parcel RSC Plugin, RSC React Router Preview, RedwoodSDK, Waku.
How to protect your program
- Update now: React ≥ 19.2.1 and Next.js ≥ 16.x fixed
- Include the update in the CI/CD pipeline.
- Check dependencies with npm audit or tools like Snyk.
- Implements strict validation of deserialized data.
- Monitor the logs for invalid requests.
- Consider a WAF (Web Application Firewall) to mitigate attacks in transit.
- Add automated security testing to your development process.
Similar incidents in the past
This type of vulnerability is reminiscent of historical flaws such as Log4Shell (2021), which affected millions of Java applications due to insecure deserialization, and the vulnerability in Apache Struts (2017), which allowed massive RCE.
Both incidents demonstrated how bugs in widely used components can become global attack vectors, affecting critical services and creating millions in costs.
Conclusion
React2Shell is a warning to the entire industry: even modern and popular technologies are not without serious risks. The combination of widespread distribution, vulnerable default configurations, and openness to the public makes this flaw a significant threat. The immediate actions are obvious: upgrade to patched versions, audit dependencies, and apply additional controls to reduce the attack surface.
