---
title: "React2Shell: Unauthenticated RCE in React Server Components"
url: https://erroneo.us/security/briefs/react2shell-react-server-components-rce/
description: "CVE-2025-55182 (CVSS 10) lets anyone run code on RSC/Next.js App Router servers. Exploited within hours. Fixed in React 19.0.1/19.1.2/19.2.1. Act now."
type: security-brief
section: "Security Digest"
date_published: 2025-12-03
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2025-55182"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# React2Shell: Unauthenticated RCE in React Server Components

**Verdict: Act now.** If any server you run renders React Server Components and was not patched in December 2025, treat it as compromised until shown otherwise: patch, redeploy, and rotate its secrets.

- **Who must act:** Anyone running Next.js 15.x/16.x App Router (or 14.3 canaries), or another framework bundling react-server-dom-* 19.0.0-19.2.0, on a reachable server.
- **Who can relax:** Client-only React apps, Next.js Pages Router or Edge Runtime apps, Next.js 13.x/14.x stable, and React Native apps without server components.
- **Affected:** react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack 19.0.0, 19.1.0, 19.1.1, 19.2.0; Next.js 15.x and 16.x (App Router) before the patched releases; Next.js 14.3.0-canary.77 and later canaries; Frameworks bundling those packages: React Router (RSC APIs), Waku, RedwoodSDK, @vitejs/plugin-rsc, @parcel/rsc
- **Fixed:** react-server-dom-* 19.0.1, 19.1.2, 19.2.1; Next.js 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 (initial fix); Next.js 14.2.35, 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.10, 15.5.10, 16.0.11, 16.1.5 (current guidance, also covers follow-up DoS/source-exposure CVEs)
- **CVEs:** CVE-2025-55182
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every app that ships react-server-dom-webpack/parcel/turbopack: npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack next
2. Upgrade to the current patched line from React's advisory (for Next.js, e.g. npm install next@15.5.10 or next@16.1.5, or run npx fix-react2shell-next), rebuild and redeploy
3. If the app was online and unpatched as of Dec 4, 2025, 1:00 PM PT, rotate every secret it can read, starting with the most critical
4. Do not rely on WAF or hosting-provider mitigations as a substitute for upgrading
5. Hunt for compromise on servers that ran vulnerable builds (see detection steps)

### How to check if you are affected

- Check deployed lockfiles/images for react-server-dom-* 19.0.0-19.2.0 or unpatched next versions
- Search web logs for POST requests carrying next-action or rsc-action-id headers with bodies containing $@ or "status":"resolved_model"
- Look on app servers for unexpected child processes of node, recon commands (whoami, id), reads of /etc/passwd, and new files in /tmp
- Look for remote-management agents (e.g. MeshAgent) or crypto miners installed after Dec 3, 2025

## What happened

On December 3, 2025, the React team disclosed **CVE-2025-55182**, an unauthenticated remote code execution flaw in React Server Components (RSC), rated CVSS 10.0. Per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-55182), the vulnerable code "unsafely deserializes payloads from HTTP requests to Server Function endpoints." The researcher Lachlan Davidson reported it through Meta's bug bounty on November 29. A fix was published to npm the same day as disclosure, according to the [React advisory](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components).

The industry nicknamed it React2Shell. Next.js first tracked its downstream impact as CVE-2025-66478 (GHSA-9qr9-h5gf-34mp), but that CVE was later rejected as a duplicate of CVE-2025-55182, [Rapid7 notes](https://rapid7.com/blog/post/etr-react2shell-cve-2025-55182-critical-unauthenticated-rce-affecting-react-server-components).

## Who is affected

The affected packages are `react-server-dom-webpack`, `react-server-dom-parcel` and `react-server-dom-turbopack`, versions 19.0, 19.1.0, 19.1.1 and 19.2.0. Any framework that bundles them is also exposed. React names next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk. For Next.js, the [Next.js advisory](https://nextjs.org/blog/CVE-2025-66478) lists App Router apps on 15.x and 16.x, plus 14.3.0-canary.77 and later canaries. Next.js 13.x, 14.x stable, Pages Router apps and the Edge Runtime are not affected.

The trap is that you do not need to have written any Server Functions. Rapid7 reports that an app can be vulnerable simply because it supports React Server Components.

## Do you really need to act?

Yes, if you run an affected framework on a reachable server. This is about as bad as web-framework bugs get. The attacker needs no account, sends one crafted HTTP request, and runs code inside your Node process with access to its environment variables.

Exploitation was fast. AWS threat intelligence [saw attacks](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/) "within hours of the public disclosure." It attributed some of them to China-nexus groups it tracks as Earth Lamia and Jackpot Panda. Rapid7 confirmed a working public exploit on December 4, and a Metasploit module followed on December 5. CISA added the CVE to the Known Exploited Vulnerabilities catalog on December 5, 2025. Rapid7's honeypots later caught attackers installing MeshAgent remote-access software.

Because exploitation started almost immediately, patching alone is not enough for an app that was online and unpatched. Next.js advises that any app "online and unpatched as of December 4th, 2025 at 1:00 PM PT" should rotate its secrets. Hosting-provider WAF rules helped, but both React and AWS say they do not replace upgrading.

Several lower-severity follow-up issues came after the RCE. React's advisory, last updated January 26, 2026, lists CVE-2025-55184, CVE-2025-67779 and CVE-2026-23864 (denial of service, CVSS 7.5) and CVE-2025-55183 (source code exposure, CVSS 5.3). That is why React's current recommended Next.js versions are higher than the first-day fixes.

## What to do now

1. Find exposure with `npm ls next react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack` in each service, and check built container images too.
2. Upgrade to the latest patched release in your line. For Next.js, React's advisory now lists 14.2.35, 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.10, 15.5.10, 16.0.11 and 16.1.5. `npx fix-react2shell-next` automates the version bump. Rebuild and redeploy, because a lockfile change alone does nothing until it ships.
3. For React Router, Waku, RedwoodSDK, Parcel and Vite RSC setups, update `react`, `react-dom` and the relevant `react-server-dom-*` package to latest, following React's instructions.
4. If the app was exposed while unpatched, rotate its secrets (database URLs, API keys, signing keys, cloud credentials).
5. Run the compromise checks below on every host that served a vulnerable build.

## How to tell if you were hit

AWS recommends searching logs for POST requests with `next-action` or `rsc-action-id` headers whose bodies contain `$@` or `"status":"resolved_model"`. Many public PoCs were broken and produced noise, so a matching request alone does not prove compromise. On the host, look for unexpected processes spawned by Node, reconnaissance commands such as `whoami` and `id`, reads of `/etc/passwd`, new files under `/tmp`, and remote-management agents or miners you did not install. Check cloud audit logs for use of credentials that the app could read.

## Timeline

- Nov 29, 2025 — Lachlan Davidson reports the flaw via Meta Bug Bounty.
- Dec 3, 2025 — React publishes fixes and discloses CVE-2025-55182. Next.js publishes its advisory.
- Dec 4, 2025 — AWS reports exploitation within hours of disclosure. Rapid7 confirms a working public PoC.
- Dec 5, 2025 — CISA adds the CVE to KEV. A Metasploit module is released.
- Dec 6, 2025 — Next.js advises secret rotation and ships `fix-react2shell-next`.
- Jan 26, 2026 — React updates its advisory with a further DoS CVE (CVE-2026-23864) and newer patched versions.

## Sources

1. [React — Critical Security Vulnerability in React Server Components](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components)
2. [Next.js — Security Advisory: CVE-2025-66478](https://nextjs.org/blog/CVE-2025-66478)
3. [CVE.org — CVE-2025-55182 record (incl. CISA KEV entry)](https://www.cve.org/CVERecord?id=CVE-2025-55182)
4. [Rapid7 — React2Shell (CVE-2025-55182) emergent threat response](https://rapid7.com/blog/post/etr-react2shell-cve-2025-55182-critical-unauthenticated-rce-affecting-react-server-components)
5. [AWS Security Blog — China-nexus cyber threat groups rapidly exploit React2Shell](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/)

---
Source page: https://erroneo.us/security/briefs/react2shell-react-server-components-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt