CVE-2025-55182: React2Shell Critical Vulnerability: What it is and what to do

A critical vulnerability (CVE-2025-55182) in React's Flight protocol enables remote code execution on servers using React Server Components. The flaw affects Next.js, React Router, Waku, and related frameworks through unsafe deserialization. Proof-of-concept exploits are publicly available and active scanning is underway. Organizations must immediately upgrade to patched versions: React Server Components to 19.0.1+, 19.1.2+, or 19.2.1+, and Next.js to 15.0.5+ or 16.0.7+. Client-only React applications and Next.js 13.x/14.x stable versions are not affected.