Critical React Server Components flaw allows unauthenticated code execution

The React team disclosed a maximum-severity vulnerability in React Server Components on Dec. 3 that lets an unauthenticated attacker run code on a web server with a single crafted HTTP request. The Canadian Centre for Cyber Security issued alert AL25-018 the next day, warning that multiple proofs of concept were available and the flaw could easily be exploited.

React is one of the most widely used web frameworks, and Server Components are on by default in recent versions of Next.js. Cloud security firm Wiz said 39 per cent of the cloud environments it monitors contained vulnerable React or Next.js versions.

What is affected

The bug, CVE-2025-55182 and nicknamed React2Shell by researchers, is an unsafe deserialization flaw in the "Flight" protocol React uses to send data to Server Function endpoints. According to the React team, it affects versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0 of the react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack packages. Fixes are in 19.0.1, 19.1.2 and 19.2.1. Apps that support Server Components can be vulnerable even if they do not define any Server Functions, while purely client-side React apps are not affected.

Frameworks that bundle the code, including Next.js 15 and 16, React Router, Waku, RedwoodSDK and the Vite and Parcel RSC plugins, needed their own updates. A separate Next.js identifier, CVE-2025-66478, was rejected as a duplicate.

Researcher Lachlan Davidson reported the flaw through Meta's bug bounty program on Nov. 29.

Exploitation

Wiz reported that Amazon saw China-nexus groups experimenting with early exploit code on Dec. 4, and that opportunistic mass exploitation began on Dec. 5. Post-exploitation activity included theft of credentials from environment variables and cloud metadata, attempted malware installs and cryptocurrency mining. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Dec. 5. The React team later disclosed related denial-of-service and source code exposure bugs.

What to do

• Upgrade react-server-dom packages to 19.0.1, 19.1.2 or 19.2.1 and update Next.js to a patched release for your branch.
• Do not rely on hosting provider or firewall mitigations alone. The React team says to update.
• If patching must wait, the Cyber Centre suggests web application firewall rules, restricting access to trusted networks or temporarily disabling Server Components.
• Rotate secrets on any server that ran a vulnerable version while exposed to the internet, and look for unexpected processes spawned by Node.js.