erroneo.us
Search all guides⌘K

Security Digest · Dec 3, 2025 · Vulnerability · Web framework

React2Shell: Unauthenticated RCE in React Server Components

CVE-2025-55182 (CVSS 10) lets anyone run code on RSC/Next.js App Router servers. Exploited within hours. Fixed in React 19.0.1/19.1.2/19.2.1. Act now.

Published By erroneo.us Security Desk · Updated 3 min read5 sources

Our verdict

Act now

If any server you run renders React Server Components and was not patched in December 2025, treat it as compromised until shown otherwise: patch, redeploy, and rotate its secrets.

Who must act: Anyone running Next.js 15.x/16.x App Router (or 14.3 canaries), or another framework bundling react-server-dom-* 19.0.0-19.2.0, on a reachable server.

Who can relax: Client-only React apps, Next.js Pages Router or Edge Runtime apps, Next.js 13.x/14.x stable, and React Native apps without server components.

Affected
react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack 19.0.0, 19.1.0, 19.1.1, 19.2.0
Next.js 15.x and 16.x (App Router) before the patched releases
Next.js 14.3.0-canary.77 and later canaries
Frameworks bundling those packages: React Router (RSC APIs), Waku, RedwoodSDK, @vitejs/plugin-rsc, @parcel/rsc
Fixed in
react-server-dom-* 19.0.1, 19.1.2, 19.2.1
Next.js 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 (initial fix)
Next.js 14.2.35, 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.10, 15.5.10, 16.0.11, 16.1.5 (current guidance, also covers follow-up DoS/source-exposure CVEs)
CVSS
10.0 (v3.1, CNA)
EPSS
99.8% (percentile 100.0)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory every app that ships react-server-dom-webpack/parcel/turbopack: npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack next
  2. Upgrade to the current patched line from React's advisory (for Next.js, e.g. npm install next@15.5.10 or next@16.1.5, or run npx fix-react2shell-next), rebuild and redeploy
  3. If the app was online and unpatched as of Dec 4, 2025, 1:00 PM PT, rotate every secret it can read, starting with the most critical
  4. Do not rely on WAF or hosting-provider mitigations as a substitute for upgrading
  5. Hunt for compromise on servers that ran vulnerable builds (see detection steps)

How to check if you are affected or compromised

  • Check deployed lockfiles/images for react-server-dom-* 19.0.0-19.2.0 or unpatched next versions
  • Search web logs for POST requests carrying next-action or rsc-action-id headers with bodies containing $@ or "status":"resolved_model"
  • Look on app servers for unexpected child processes of node, recon commands (whoami, id), reads of /etc/passwd, and new files in /tmp
  • Look for remote-management agents (e.g. MeshAgent) or crypto miners installed after Dec 3, 2025

What happened#

On December 3, 2025, the React team disclosed CVE-2025-55182, an unauthenticated remote code execution flaw in React Server Components (RSC), rated CVSS 10.0. Per the CVE record, the vulnerable code "unsafely deserializes payloads from HTTP requests to Server Function endpoints." The researcher Lachlan Davidson reported it through Meta's bug bounty on November 29. A fix was published to npm the same day as disclosure, according to the React advisory.

The industry nicknamed it React2Shell. Next.js first tracked its downstream impact as CVE-2025-66478 (GHSA-9qr9-h5gf-34mp), but that CVE was later rejected as a duplicate of CVE-2025-55182, Rapid7 notes.

Who is affected#

The affected packages are react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack, versions 19.0, 19.1.0, 19.1.1 and 19.2.0. Any framework that bundles them is also exposed. React names next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk. For Next.js, the Next.js advisory lists App Router apps on 15.x and 16.x, plus 14.3.0-canary.77 and later canaries. Next.js 13.x, 14.x stable, Pages Router apps and the Edge Runtime are not affected.

The trap is that you do not need to have written any Server Functions. Rapid7 reports that an app can be vulnerable simply because it supports React Server Components.

Do you really need to act?#

Yes, if you run an affected framework on a reachable server. This is about as bad as web-framework bugs get. The attacker needs no account, sends one crafted HTTP request, and runs code inside your Node process with access to its environment variables.

Exploitation was fast. AWS threat intelligence saw attacks "within hours of the public disclosure." It attributed some of them to China-nexus groups it tracks as Earth Lamia and Jackpot Panda. Rapid7 confirmed a working public exploit on December 4, and a Metasploit module followed on December 5. CISA added the CVE to the Known Exploited Vulnerabilities catalog on December 5, 2025. Rapid7's honeypots later caught attackers installing MeshAgent remote-access software.

Because exploitation started almost immediately, patching alone is not enough for an app that was online and unpatched. Next.js advises that any app "online and unpatched as of December 4th, 2025 at 1:00 PM PT" should rotate its secrets. Hosting-provider WAF rules helped, but both React and AWS say they do not replace upgrading.

Several lower-severity follow-up issues came after the RCE. React's advisory, last updated January 26, 2026, lists CVE-2025-55184, CVE-2025-67779 and CVE-2026-23864 (denial of service, CVSS 7.5) and CVE-2025-55183 (source code exposure, CVSS 5.3). That is why React's current recommended Next.js versions are higher than the first-day fixes.

What to do now#

  1. Find exposure with npm ls next react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack in each service, and check built container images too.
  2. Upgrade to the latest patched release in your line. For Next.js, React's advisory now lists 14.2.35, 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.10, 15.5.10, 16.0.11 and 16.1.5. npx fix-react2shell-next automates the version bump. Rebuild and redeploy, because a lockfile change alone does nothing until it ships.
  3. For React Router, Waku, RedwoodSDK, Parcel and Vite RSC setups, update react, react-dom and the relevant react-server-dom-* package to latest, following React's instructions.
  4. If the app was exposed while unpatched, rotate its secrets (database URLs, API keys, signing keys, cloud credentials).
  5. Run the compromise checks below on every host that served a vulnerable build.

How to tell if you were hit#

AWS recommends searching logs for POST requests with next-action or rsc-action-id headers whose bodies contain $@ or "status":"resolved_model". Many public PoCs were broken and produced noise, so a matching request alone does not prove compromise. On the host, look for unexpected processes spawned by Node, reconnaissance commands such as whoami and id, reads of /etc/passwd, new files under /tmp, and remote-management agents or miners you did not install. Check cloud audit logs for use of credentials that the app could read.

Timeline#

  • — Lachlan Davidson reports the flaw via Meta Bug Bounty.
  • — React publishes fixes and discloses CVE-2025-55182. Next.js publishes its advisory.
  • — AWS reports exploitation within hours of disclosure. Rapid7 confirms a working public PoC.
  • — CISA adds the CVE to KEV. A Metasploit module is released.
  • — Next.js advises secret rotation and ships fix-react2shell-next.
  • — React updates its advisory with a further DoS CVE (CVE-2026-23864) and newer patched versions.

Vulnerability records

  • CVE-2025-55182 · KEV 2025-12-05 · A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. React — Critical Security Vulnerability in React Server Components react.dev
  2. Next.js — Security Advisory: CVE-2025-66478 nextjs.org
  3. CVE.org — CVE-2025-55182 record (incl. CISA KEV entry) cve.org
  4. Rapid7 — React2Shell (CVE-2025-55182) emergent threat response rapid7.com
  5. AWS Security Blog — China-nexus cyber threat groups rapidly exploit React2Shell aws.amazon.com