CVE‑2025‑55182 (“React2Shell”): What You Need to Know

A critical security flaw, CVE‑2025‑55182, was discovered in React Server Components (RSC). Dubbed React2Shell, it lets attackers run code on your server without logging in. If your website uses React or frameworks like Next.js, you could be at risk.

What’s the Problem?

• The vulnerability happens because server functions trust incoming data too much.
• An attacker can send a specially crafted request, and the server will execute it.
• This can lead to full server compromise: stealing data, installing malware, or taking over the site.

Who is Affected?

• React Server Components (react-server-dom-* packages) versions 19.0.0–19.2.0
• Next.js 15.x and 16.x, plus some canary releases
• Any project using RSC in default configurations

Even vanilla projects (created with create-next-app) may be vulnerable.

How Bad Is It?

• Rated CVSS 10.0, the highest severity.
• No login needed — anyone can attack your server.
• Exploit code is publicly available, so attackers can act fast.

What Should You Do?

1. Check your dependencies — see if you use React Server Components.
2. Upgrade immediately:

• React: react-server-dom-* patched in 19.0.1, 19.1.2, 19.2.1
• Next.js: patched versions like 15.0.5, 16.0.7

3. Rebuild and redeploy after updating.

4. If you can’t patch yet, block suspicious requests and monitor logs.

Why It Matters

This vulnerability shows that even popular frameworks can be risky. Default setups that are “just working” can still be exploited. Teams should act fast, audit dependencies, and patch now.

CVE‑2025‑55182 is a wake-up call: if you use React or Next.js on the server, update immediately. Don’t wait — attackers are already targeting this flaw.

• If you’re a user: You don’t need to do anything — your safety depends on the websites you visit, not your device.
• If you’re a developer: Update React Server Components and Next.js immediately to patched versions. Rebuild and redeploy your applications.
• If you’re a business owner or manager: Check with your dev team to confirm that your website or app is running a patched version — don’t wait, this vulnerability is actively being exploited.

If you can’t patch yet, block suspicious requests and monitor logs.