<p>The React2Shell vulnerability, identified as CVE-2025-55182, is a critical remote code execution flaw affecting React Server Components in React versions 19.0 through 19.2.0 and Next.js versions 15.x to 16.x. This vulnerability has been assigned a maximum CVSS score of 10.0 due to its severe implications, enabling unauthenticated attackers to execute arbitrary code on servers through insecure deserialization in the Flight protocol.</p>
<h3>Exploit Mechanism</h3>
<p>The vulnerability arises from unsafe deserialization in React’s Flight protocol, which manages server-client component communication. Attackers can exploit this flaw by sending specially crafted HTTP requests that manipulate serialized data, allowing them to traverse prototype chains and execute malicious code via the JavaScript Function constructor. This process is akin to historical Java serialization issues, where unchecked deserialization enabled remote code execution.</p>
<h3>Active Exploitation</h3>
<p>Since its disclosure, the React2Shell vulnerability has been actively exploited by various threat actors, including state-sponsored groups from China and North Korea, as well as financially motivated cybercriminals. Exploits have been observed deploying cryptocurrency miners, backdoors like KSwapDoor and ZnDoor, and other malware across multiple sectors such as construction, entertainment, and critical infrastructure.</p>
<h3>Immediate Actions and Patches</h3>
<p>Organizations using React Server Components are strongly urged to upgrade to the patched versions of React (19.0.1, 19.1.2, and 19.2.1) and Next.js (15.0.5 and 16.0.7). Alongside these updates, deploying Web Application Firewall (WAF) rules and restricting endpoint access can provide temporary mitigations.</p>
<h3>Broader Impact</h3>
<p>The vulnerability affects an estimated 39% of cloud environments and 6% of all websites, making it a comparable threat to the infamous Log4j flaw. Security measures such as secret rotation and server rebuilding are recommended if systems are suspected to be compromised. Meanwhile, Cloudflare, AWS, and other cloud service providers have responded with automatic protections and increased monitoring of exploitation attempts.</p>
<h3>Conclusion</h3>
<p>The React2Shell vulnerability underscores the importance of secure deserialization practices and validates the need for immediate and comprehensive response strategies in handling emergent security threats. This incident illustrates a significant challenge for the global IT community, reaffirming the necessity of timely patch deployment and vigilance against rapidly industrializing threat actors.</p>


Collections

React2Shell (CVE-2025-55182) is a critical remote code execution vulnerability with a CVSS score of 10.0, affecting React 19.0-19.2.0 and Next.js 15.x-16.x. The flaw stems from unsafe deserialization in React's Flight protocol, allowing unauthenticated attackers to execute arbitrary code through crafted HTTP requests. State-sponsored groups and cybercriminals are actively exploiting it to deploy cryptocurrency miners and backdoors. Organizations must upgrade to patched versions (React 19.0.1+, Next.js 15.0.5+) immediately, as the vulnerability impacts 39% of cloud environments and 6% of all websites. WAF rules and endpoint restrictions provide temporary mitigation.

Critical Vulnerability in React Server Components: Immediate Action Required

<p>It’s time, definitely update your Next/React projects <em><strong>immediately!</strong></em>
Don’t get caught with your pants down 😯
Didn’t realize until now it was a 10/10, that’s bad.</p>


<p>check out <a href="https://npmscan.com/" target="_blank" rel="noopener nofollow">https://npmscan.com/</a> for more threats like this</p>


<p>Hackers are always looking for vulnerabilities. I made this image to explain it:</p>
<p><img src="https://media.daily.dev/image/upload/s--NCT50YLn--/f_auto/v1764874741/ugc/content_b07b70bb-9143-4d07-b2b1-1ea87c767ec4?_a=BAMAK+ZW0" alt="1000048179"></p>


<p>Most of the react code in production runs an older version of react 16. I.e no server components. Don’t worry the Internet is safe</p>


<p>I heard it already, but this is new one.</p>
