CVE-2025-55182, also known as React2Shell, is a critical pre-authentication remote code execution (RCE) vulnerability affecting React Server Components, Next.js, and related frameworks. With a CVSS score of 10.0, attackers can exploit this flaw using a single malicious HTTP request, potentially compromising servers globally.
React Server Components enable React 19 applications to run parts of their logic on the server using the Flight protocol. The vulnerability exists because affected versions fail to validate incoming payloads, allowing attackers to inject malicious code.
Affected Versions:
- react-server-dom-webpack: 19.0, 19.1.0, 19.1.1, 19.2.0
- react-server-dom-parcel: same versions
- react-server-dom-turbopack: same versions
Recommended Actions for Organizations Using React or Next.js:
- Apply Security Updates Promptly: Upgrade to the latest official patch release to protect against all related vulnerabilities.
The current secure version is: React Server Components v19.2.3 or newer.
This release consolidates fixes for:
CVE‑2025‑55182 (React2Shell; Remote Code Execution)
CVE‑2025‑55183 (Information Disclosure)
CVE‑2025‑55184 and CVE‑2025‑67779 (Denial-of-Service)
Additionally, ensure your Next.js framework is updated to a version that incorporates this patch. For example: Next.js v16.0.7 or newer.
- Implement Temporary Protections: Deploy Web Application Firewall rules to block known exploit patterns while patching is underway.
- Review Application Dependencies: Audit all projects for vulnerable React Server Components packages, including indirect dependencies.
- Monitor for Suspicious Activity: Check logs for unusual outbound traffic (e.g., wget or curl initiated by unknown web server processes).
- Conduct Threat Hunting: Investigate for compromise indicators such as hidden directories like $HOME/.systemd-utils, termination of critical processes (e.g., ntpclient), and malicious code injected into shell configuration files (e.g., .bashrc).
Sources:
NIST: NVD – CVE-2025-55182
Microsoft Security Blog – Defending against the CVE-2025-55182 (React2Shell) vulnerability in React Server Components | Microsoft Security Blog
SocPrime Analysis: React2Shell Vulnerability: Maximum-Severity Flaw in React Server Components Actively Exploited by China-Backed Groups | SOC Prime
Google Cloud Threat Intelligence: Multiple Threat Actors Exploit React2Shell (CVE-2025-55182) | Google Cloud Blog
React Patch Notes: React Blog – React