React2Shell (CVE-2025-55182): Description and How We Mitigate on Our Project?

Abstract

In late November 2025, a critical vulnerability—CVE-2025-55182, informally known as React2Shell—was disclosed in React’s Server Components Flight protocol. Under certain conditions, this vulnerability enabled unauthenticated remote code execution (RCE) in millions of modern React applications.

This post documents how one of our Next.js sites was affected, what we observed during the incident, and the concrete remediation steps we took.

This is not an exploit tutorial.
The goal is to help engineers understand the architectural failure, recognize exposure signals, and respond effectively.

Background: Our Architecture

The affected application was built using:

• Next.js (App Router)
• Node.js runtime deployed on a public-facing server

Notably:

• No custom React Server Actions were intentionally defined.
• We believed we were not using React Server Functions directly.

However, as this incident made clear, support for React Server Components alone was sufficient to expose the vulnerable attack surface.

What Is React2Shell?

React2Shell is the informal name given by the security community to CVE-2025-55182, a critical vulnerability in React’s Server Components infrastructure.

The name reflects the severity of the issue: under the right conditions, a crafted HTTP request can lead directly from React to a server shell.

At its core, React2Shell is an unauthenticated remote code execution (RCE) vulnerability caused by unsafe deserialization in the React Flight protocol. The Flight protocol is responsible for transmitting Server Component trees and Server Function calls between the browser and the server.

Unlike traditional API endpoints, Flight endpoints are:

• Automatically exposed by frameworks like Next.js
• Designed to accept complex, structured payloads
• Decoded and executed before application-level authentication

This combination created an unexpected and extremely powerful attack surface.

What Makes React2Shell Different From Typical Web Vulnerabilities

Most high-impact web vulnerabilities require at least one of the following:

• Authentication bypass
• A misconfigured server
• User interaction (clicks, uploads, etc.)

React2Shell requires none of these.

An attacker only needs:

• Network access to the server
• Knowledge that the application supports React Server Components

From there, a single malicious request can compromise the entire server process.

What Can React2Shell Do?

Successful exploitation of React2Shell effectively grants the attacker the same capabilities as the Node.js process running your application.

Full Server Compromise

An attacker can:

• Execute arbitrary JavaScript on the server
• Spawn shell commands
• Read and write files
• Install persistent backdoors

In practical terms, this means complete control of the application server.

Secret and Credential Theft

Because React runs inside the Node.js runtime, exploitation grants access to:

• process.env (API keys, database passwords, OAuth secrets)
• Configuration files
• Cloud provider credentials

Once exfiltrated, these secrets can be reused even after the application is patched unless they are rotated.

---

Database and User Data Access

With stolen credentials or direct runtime access, an attacker can:

• Query or dump databases
• Modify or delete user records
• Insert malicious data or administrative accounts

This directly impacts user privacy and data integrity.

How Are End Users Affected?

Although React2Shell is a server-side vulnerability, its consequences are felt most strongly by end users.

Data Exposure

Users may experience:

• Leakage of personal information
• Stolen password hashes
• Exposure of payment or identity data

Even when passwords are not stored in plaintext, secondary attacks such as credential stuffing become possible.

Account Takeover

If session stores, JWT signing keys, or OAuth secrets are compromised, attackers can:

• Forge valid authentication tokens
• Hijack active sessions
• Impersonate users or administrators

From the user’s perspective, accounts may be taken over without any obvious sign of phishing or malware.

Malware and Trust Erosion

A compromised server can also:

• Serve malicious JavaScript to visitors
• Inject tracking or cryptomining scripts
• Redirect users to phishing pages

Even after remediation, user trust can be permanently damaged.

Why This Was Rated CVSS 10.0

React2Shell received the maximum CVSS score (10.0) due to the following characteristics:

• Attack vector: Remote
• Privileges required: None
• User interaction: None
• Exploit complexity: Low
• Impact: Complete compromise of confidentiality, integrity, and availability

In short, this vulnerability represents a worst-case security failure scenario.

Technical Root Cause (High-Level)

React2Shell (CVE-2025-55182) is a deserialization vulnerability in React’s Flight protocol—the internal mechanism used to transmit Server Component trees and Server Function calls between client and server.

At a high level:

• React exposes internal Flight endpoints (for RSC payloads)
• These endpoints accept structured payloads from the client
• React deserializes these payloads into runtime objects
• Insufficient validation allowed attacker-controlled input to influence execution during deserialization

The result was remote code execution prior to authentication or application-level logic.

Why Our Site Was Vulnerable

Our site met all the risk criteria:

• Publicly accessible
• Used Next.js App Router

Critically:

Even without defining a single Server Action, the framework still exposed Flight endpoints required for Server Components.

This meant the attack surface existed by default.

Incident Response: What We Did

We were notified by Vercel that the Next.js version we were using was affected by the React2Shell vulnerability.

1. Automated Remediation Using the Next.js Fix Utility

As part of our response, we used the official remediation utility provided for Next.js projects. This tool inspects the project’s dependency tree and upgrades React, React DOM, and internal Server Components packages to patched versions.

First, we verified our Next.js version:

npx next -v

Fig: Finding Next Js Version

We followed the Official Fix recommended by the NextJs

npx fix-react2shell-next

Fig: Vulnerability Scanner

What the Utility Does

This utility:

• Recursively scans all package.json files (including monorepos)
• Detects vulnerable versions of:
  • next
  • react-server-dom-webpack
  • react-server-dom-parcel
  • react-server-dom-turbopack
• Patches dependencies to the correct fixed versions
• Refreshes the lockfile using the detected package manager

During this process, we also discovered two additional vulnerabilities, which were remediated using npm audit.

Fig: Fixed 2 vulnerabilities with audit-fix

2. Secret Rotation and Session Invalidation

Assuming worst-case exposure, we took the following actions:

• Rotated all environment secrets
• Regenerated API keys and database credentials
• Invalidated all active user sessions

This step was critical because successful exploitation grants access to:

• process.env
• The file system
• Network capabilities

---

Final Thoughts

React2Shell exposed an uncomfortable reality: modern framework abstractions can quietly introduce critical attack surfaces by default. Even applications with no explicit server actions were vulnerable simply by enabling React Server Components.

Key Takeaways

• Patch immediately
• Rotate secrets aggressively
• Assume compromise when RCE is involved
• Re-evaluate the security implications of framework-level features

If you are running Next.js with the App Router, you should assume exposure unless proven otherwise.

For learning more:

• Visit Vercel Documentation
• Visit Official React Blog