CVE-2025-55182: Critical RCE in React Server Components
In early December 2025, a critical vulnerability was disclosed in React Server Components that allows unauthenticated remote code execution. Tracked as CVE-2025-55182 (sometimes called React2Shell), the issue carries a CVSS score of 10.0 and affects default configurations of React 19 and frameworks that use it, including Next.js.
What is affected
The vulnerability is present in the React Server Components “Flight” protocol. Affected versions include React 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of the relevant server packages, as well as Next.js 15.x and 16.x applications using the App Router. Patched versions were released promptly (React 19.0.1 / 19.1.2 / 19.2.1 and corresponding Next.js releases).
Why it matters
Exploitation requires only a crafted HTTP request to a Server Function endpoint. No authentication is needed. Because many organizations run Next.js or React Server Components in production, the potential attack surface is large. Subsequent related issues (information disclosure and denial-of-service conditions) were also disclosed, but the original RCE is the primary concern.
What to do
- Identify applications using React Server Components or Next.js App Router.
- Upgrade to a patched release as soon as practical.
- Review logs for unusual requests to Server Function endpoints around the disclosure window.
- Consider a targeted penetration test or change-detection cycle if the application is high-value and the patch was delayed.
This post is for awareness only. It does not include exploit details.