React2Shell: The Critical Vulnerability Rocking the Web — And Why It Matters

A newly disclosed security flaw in React and Next.js — two of the most essential tools in modern web development — has sent shockwaves through the developer community and cloud security sectors. Dubbed “React2Shell,” this vulnerability is formally identified as CVE-2025-55182 (in React) and CVE-2025-66478 (in Next.js). It carries a maximum severity rating of 10.0 (CVSS) and can enable unauthenticated remote code execution (RCE) on servers under default configurations — essentially giving attackers complete control over compromised backend systems.

What Is React2Shell — And How Does It Work

At the heart of the issue lies the architecture known as React Server Components (RSC) and its associated internal communication protocol called “Flight.” RSC allows server-side rendering and logic to be integrated into React applications, enhancing performance and flexibility. In a typical setup, RSC payloads — which include data that describes what to render or which functions to call — are sent from clients to servers, deserialized, and executed server-side.

React2Shell exploits a fundamental flaw in the deserialization process. Attackers can craft specially engineered HTTP requests that feature malformed or adversarially structured RSC payloads. Unfortunately, because the “Flight” protocol fails to adequately validate the structure of these payloads, the attacker-controlled data may be interpreted and executed as legitimate server-side code. Essentially, this vulnerability allows an attacker to run arbitrary JavaScript on the server — without requiring credentials or a user session, simply by making a call over HTTP.

Critically, this isn’t a corner-case vulnerability. Even default installations created using standard tooling (such as create-next-app) are vulnerable. This means that many newly generated websites and applications — even if they don’t explicitly implement “Server Functions” — could be at risk simply because they support RSC.

Scope and Impact: Why So Many Projects Are at Risk

The scale of this vulnerability is staggering. The core packages affected — react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack — are included in React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0.

Downstream, any framework or bundler that incorporates these packages may also be compromised — including Next.js (versions 15.x and 16.x, alongside specific 14.x canary builds), as well as other emerging frameworks and plugins that support RSC, such as Vite, Parcel, React Router, RedwoodSDK, and Waku.

According to cloud security firm Wiz, nearly 39% of cloud environments they observed contain vulnerable instances of React or Next.js — a significant share of the internet’s backend infrastructure.

Based on usage statistics and the penetration of these ecosystems, this vulnerability has the potential to affect millions of applications globally — ranging from small personal websites to extensive enterprise SaaS platforms.

Why React2Shell Is Especially Dangerous

Several factors converge to make React2Shell particularly concerning:

• Unauthenticated & Remote: Exploitation requires no login or special permissions; it merely requires network access.
• Default Configuration is Vulnerable: Many developers using standard toolchains will have their systems exposed without realizing it.
• Wide Ecosystem Reach: React and Next.js underpin a vast number of sites and services, hence the immense attack surface.
• Ease of Exploitation: A single crafted HTTP request can trigger full RCE, with security firms reporting success rates nearing “near-100% reliability.”
• Potential for Severe Consequences: A successful compromise could lead to full control over backend servers, including data theft, database dumps, server-side manipulation, or even broader systemic impacts.

The revelation that such a fundamental vulnerability exists in one of the most widely used web-development ecosystems — particularly in code paths many assumed were “safe by default” — has shaken confidence throughout the JavaScript community.

What’s Already Being Done (And What You Should Do Right Now)

The disclosure process has been rapid. Independent security researcher Lachlan Davidson responsibly reported the root vulnerability on November 29, 2025. The teams behind React and Next.js acted swiftly: by December 3, they had publicly disclosed the flaw and released patched versions.

• React packages have been patched in versions 19.0.1, 19.1.2, and 19.2.1.
• Next.js releases that include patches are 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7.

Major infrastructure and cloud-hosting providers like Google Cloud have already begun implementing mitigation measures, urging customers to update immediately or apply temporary Web Application Firewall (WAF) rules to block exploit attempts.

However, patches and WAF rules are just the beginning. Security analysts and defenders recommend that:

• All affected projects — including newly created ones — must audit dependencies (e.g., package.json, package-lock.json) for vulnerable versions of React or any RSC-enabled libraries.
• Applications built on frameworks like Next.js or utilizing bundlers/plugins that support RSC (like Vite-RSC or Parcel-RSC) should upgrade immediately — even if they believe they’re not using “server functions.”
• Exposure from public servers is particularly precarious; any internet-facing React/Next.js server could easily be probed and exploited.

Security researchers have warned that actual “in-the-wild” exploitation is likely imminent, if it hasn’t started already.

What This Means for the Web Ecosystem — And What to Watch

React2Shell transcends being merely a bug; it highlights a systemic failure in a core deserialization mechanism and is a serious wake-up call for the entire JavaScript ecosystem.

• For open-source maintainers and library authors: This serves as a reminder that default configurations are not always safe. Any code — even internal protocol code like RSC “Flight” — can become a perilous vector if input handling and validation are not rigorously managed.
• For web developers and DevOps teams: Maintaining vigilant dependency hygiene, including regular audits and aggressive patching cycles, must become a standard security practice.
• For cloud providers and hosting platforms: While default firewall or WAF protections can assist in the short term, long-term security relies on effective dependency management and timely patching.
• For users and end-customers of web services: Follow-up patches may induce disruptions or version rollouts, but the risks associated with inaction — such as data breaches, server takeovers, or even embedded backdoors — are considerably greater.

In summary: React2Shell serves as a stark reminder that popularity does not equal safety. Even widely used and trusted tools can hide critical architectural flaws. The rapid discovery, disclosure, and patching of this vulnerability underscores the importance of responsible security research, while also shining a light on the fragility within modern web-development ecosystems.