--- title: React2Shell (CVE-2025-55182): Critical RCE in React... description: Discussion about "React2Shell (CVE-2025-55182): Critical RCE in React Server Components and Next.js" on daily.dev - join the developer community canonical: https://daily.dev/posts/react2shell-cve-2025-55182-critical-rce-in-react-server-components-and-next-js-t6sm0zmd0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: React2Shell (CVE-2025-55182): Critical RCE in React Server Components and Next.js | daily.dev og:description: Discussion about "React2Shell (CVE-2025-55182): Critical RCE in React Server Components and Next.js" on daily.dev - join the developer community og:url: https://daily.dev/posts/react2shell-cve-2025-55182-critical-rce-in-react-server-components-and-next-js-t6sm0zmd0 og:image: https://api.daily.dev/og/posts/t6sm0zMD0.png og:image:alt: React2Shell (CVE-2025-55182): Critical RCE in React Server Components and Next.js og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # React2Shell (CVE-2025-55182): Critical RCE in React Server Components and Next.js **[Wilson Kinyua](https://daily.dev/sources/93k9vw6wigajmupqijkco)** · [@wilsonkinyua](https://daily.dev/wilsonkinyua) · 2 upvotes · 1 comments ## Content In early December 2025, the React and Next.js ecosystem was hit with a critical remote code execution (RCE) vulnerability in React Server Components (RSC), now widely known as **React2Shell**. Tracked as **CVE-2025-55182**, this issue allows an unauthenticated attacker to execute arbitrary code on servers running vulnerable React RSC implementations, including many modern Next.js apps using the App Router. If your app was created recently with `create-next-app` and deployed without extra hardening, there's a good chance it was affected before you upgraded. --- ## Where This Vulnerability Came From The root cause lies in React's RSC "Flight" protocol, which defines how server components serialize and stream data to the client. Under certain conditions, the server-side handling of these RSC payloads allowed unsafe deserialization, opening a path to arbitrary code execution. Security researcher **Lachlan Davidson** privately disclosed the issue to Meta's React team on November 29, 2025, and it was assigned **CVE-2025-55182** with a maximum CVSS score of **10.0**. React and Vercel coordinated patches that shipped publicly on December 2–3, 2025, followed by advisories from cloud vendors, security companies, and national CERTs. > **Note on CVE tracking:** You may see references to CVE-2025-66478 for Next.js specifically. This CVE was later rejected by the National Vulnerability Database (NVD) as a duplicate of CVE-2025-55182, so both React and Next.js vulnerabilities are now tracked under the single CVE-2025-55182 identifier. --- ## How It Affects Websites and Servers The vulnerability lets an attacker send specially crafted RSC requests that the server parses and executes in unsafe ways. Because RSC processing lives on the server, successful exploitation can lead to full RCE: running arbitrary commands, accessing environment variables, or pivoting deeper into your infrastructure. Security researchers at Wiz constructed a fully working RCE proof-of-concept with near-100% reliability. Within hours of public disclosure, multiple security firms observed active exploitation in the wild. **This is not theoretical.** Amazon's threat intelligence teams observed attackers establishing shells to harvest credentials from environment variables, filesystems, and cloud instance metadata. In some compromised environments, attackers attempted to identify and exfiltrate AWS credentials. At other organizations, exploitation was followed by attempts to install malware frameworks like Sliver. --- ## Who Is Affected ### React Core The vulnerability affects server-side use of React 19 with React Server Components enabled. According to React's official advisory, the following versions are vulnerable: - React 19.0.0 - React 19.1.0, 19.1.1 - React 19.2.0 **Patched React versions:** - 19.0.1 - 19.1.2 - 19.2.1 ### Next.js Any framework that embeds RSC support on the server is in scope. For Next.js specifically: **Affected versions:** - All Next.js 15.x versions before their patched releases (including 15.0.x, 15.1.x, 15.2.x, etc.) - Next.js 16.0.0–16.0.6 - Next.js 14.3.0‑canary.77 and later 14.x canary builds using App Router + RSC​ **Patched versions (upgrade to at least):** - 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, or 15.5.7 - 16.0.7 or higher - Stable Next.js 14.x (avoid canary builds in production) ### Other Affected Projects The vulnerability also affects other RSC implementations: - React Router (RSC preview) - Waku - Redwood SDK - @parcel/rsc - @vitejs/plugin-rsc If you're running a typical App Router project created recently with `create-next-app` on 15.x or 16.x, **assume you were affected until you upgrade**. --- ## In practice: React Server Components rely on a binary protocol called Flight to serialize component trees and data between server and client. In vulnerable versions, the server trusted certain parts of this payload too much, allowing an attacker-controlled message to influence how values are resolved on the server. In practice: 1. An attacker sends a crafted HTTP request targeting the RSC endpoint in a vulnerable app 2. The server parses the payload and, due to unsafe deserialization, ends up calling dangerous APIs under some conditions 3. The result is unauthenticated RCE on the machine running your Next.js server or serverless function **No special misconfiguration or app-level bug is required.** The vulnerability exists in the framework's RSC path itself under default settings—a standard Next.js app created with `create-next-app` and built for production can be exploited with no code changes by the developer. --- ## How to Fix It There is no reliable config toggle or middleware workaround. **The fix is to upgrade React and Next.js to patched versions and redeploy.** ### Step 1: Check If Your App Is Vulnerable Inspect your `package.json` for `next`, `react`, and `react-dom` versions: ```bash cat package.json | grep -E '"(next|react|react-dom)"' ``` You are vulnerable if: - `next` is in the 15.0.0–15.0.4 or 16.0.0–16.0.6 range - You're on 14.3.0-canary.77 or later canary builds - `react` is 19.0.0, 19.1.0, 19.1.1, or 19.2.0 ### Step 2: Upgrade to Patched Versions For most projects, upgrade to the latest patched stable in your major line: ```bash # General case - upgrade to latest npm install next@latest react@latest react-dom@latest # Or with yarn yarn add next@latest react@latest react-dom@latest # Or with pnpm pnpm add next@latest react@latest react-dom@latest ``` If you need to stay within specific majors: ```bash # For Next.js 15.x npm install next@15.0.5 react@19.0.1 react-dom@19.0.1 # For Next.js 16.x npm install next@16.0.7 react@latest react-dom@latest ``` ### Step 3: Scan Your Dependencies Beyond this specific vulnerability, it's good practice to scan your npm packages for security issues. Tools you can use: **npm audit** (built-in): ```bash npm audit npm audit fix ``` **[npmscan.com](https://npmscan.com/)** — A browser-based tool focused on detecting malware, crypto-drainers, and supply-chain attacks that traditional CVE databases might miss. Simply paste your `package.json` content for instant analysis. Unlike `npm audit` which only checks known CVEs, npmscan uses heuristics to detect suspicious behavior patterns like obfuscation, exfiltration attempts, and malicious postinstall hooks. For sensitive/private codebases, review their privacy policy before pasting your full package.json, or stick to npm audit inside your CI. ### Step 4: Rebuild and Redeploy After upgrading: 1. **Rebuild your application:** ```bash npm run build ``` 2. **Redeploy to production** (Vercel, your own Node server, containers, etc.) 3. **Review logs and monitoring** for suspicious RSC-related traffic or unexpected process behavior, especially if your app was publicly exposed before the patch window 4. **Look for indicators of compromise:** - Unexpected outbound network connections - Suspicious processes spawned by your Node.js application - Unauthorized access to environment variables or secrets - POST requests with `next-action` or `rsc-action-id` headers in your logs --- ## Who Should Treat This as Urgent You should treat this as an **immediate incident** if: - You run a public Next.js App Router app on 15.x or 16.x with RSC enabled, especially on self-hosted infrastructure - Your servers have direct access to sensitive resources (databases, message queues, internal APIs, secrets) - You manage multi-tenant SaaS where compromise of one Node process could expose multiple customers - You haven't updated your Next.js or React dependencies since before December 3, 2025 Cloud providers and managed platforms (Vercel, AWS, Google Cloud) have added protective filtering, but all of them emphasize that **upgrading your app's dependencies is mandatory**—platform-level mitigations are not a substitute for patching. --- ## Why This Matters for Everyday Next.js Developers For most of us, this incident is a reminder that "framework defaults" are still security-sensitive code paths. You don't have to be doing anything fancy with RSC for a vulnerability like this to affect you—simply using the modern App Router with current defaults was enough. On the positive side, the coordinated response between the React team, Vercel, security researchers, and cloud vendors has been fast and transparent. If you keep a disciplined habit of dependency updates and subscribe to framework security advisories, you're already doing one of the highest-leverage things you can do for your app's security posture. --- ## Resources - [React Official Advisory](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) - [React2Shell Information Site](https://react2shell.com/) - [Wiz Technical Analysis](https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182) - [Google Cloud Response Guide](https://cloud.google.com/blog/products/identity-security/responding-to-cve-2025-55182) - [AWS Security Bulletin](https://aws.amazon.com/security/security-bulletins/AWS-2025-030/) - [Datadog Security Labs Analysis](https://securitylabs.datadoghq.com/articles/cve-2025-55182-react2shell-remote-code-execution-react-server-components/) *** If you’d like to see how I’m building and securing real-world React/Next.js projects, you can check out my portfolio and resume here: **[https://wilsonkinyua.com/](https://wilsonkinyua.com/)** ## Community discussion Top comments from developers on daily.dev. **@shyngysdev** · 0 upvotes > make sense --- [View this post on daily.dev](https://daily.dev/posts/react2shell-cve-2025-55182-critical-rce-in-react-server-components-and-next-js-t6sm0zmd0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/react2shell-cve-2025-55182-critical-rce-in-react-server-components-and-next-js-t6sm0zmd0","headline":"React2Shell (CVE-2025-55182): Critical RCE in React Server Components and Next.js","text":"Discussion about \"React2Shell (CVE-2025-55182): Critical RCE in React Server Components and Next.js\" on daily.dev - join the developer community","url":"https://daily.dev/posts/react2shell-cve-2025-55182-critical-rce-in-react-server-components-and-next-js-t6sm0zmd0","datePublished":"2025-12-07T17:06:47.698Z","dateModified":"2025-12-07T17:06:47.698Z","author":{"@type":"Person","name":"Wilson Kinyua","url":"https://daily.dev/wilsonkinyua","image":"https://lh3.googleusercontent.com/a/ACg8ocKW21irMHz8luw7ZILiwvVNvHoBpKJYrwIGthXPoZshRaaybQ=s96-c","description":"Senior Frontend Engineer | Next.js, Nuxt.js, TypeScript | I help SaaS \u0026 Fintech teams ship fast.","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":20}},"image":"https://media.daily.dev/image/upload/s--V4ZPtcNO--/f_auto/v1765127212/posts/t6sm0zMD0?_a=BAMAK+ZW0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"comment":[{"@type":"Comment","text":"make sense","datePublished":"2026-07-21T21:07:06.993Z","url":"https://daily.dev/posts/t6sm0zMD0#c-vLQEpW9ri","author":{"@type":"Person","name":"Shyngys Shynbolatov","url":"https://daily.dev/shyngysdev","image":"https://avatars.githubusercontent.com/u/42411937?v=4"}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/93k9vw6wigajmupqijkco","name":"Wilson Kinyua"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Wilson Kinyua","item":"https://daily.dev/sources/93k9vw6wigajmupqijkco"},{"@type":"ListItem","position":3,"name":"React2Shell (CVE-2025-55182): Critical RCE in React Server Components and Next.js"}]} ```