React2Shell (CVE-2025-55182): Critical RCE in RSC

React2Shell (CVE-2025-55182): Critical RCE in React Server Components

React2Shell, tracked as CVE-2025-55182, is a critical remote code execution vulnerability in React Server Components (RSC) that has already been exploited in the wild against internet-facing services. Because the flaw lives in RSC itself, it also affects Next.js and other frameworks built on top of React Server Components.

What happened

The vulnerability allows remote code execution through React Server Components. Client-only React applications that do not use Server Components are not affected, but anything running RSC server-side is in scope.

Affected React packages: react-server-dom-parcel, react-server-dom-webpack, react-server-dom-turbopack

• Vulnerable versions: 19.0.0, 19.1.0, 19.1.1, 19.2.0
• Fixed versions: 19.0.1, 19.1.2, 19.2.1

Next.js (App Router / RSC):

• Vulnerable versions: 15.x, 16.x, and canary builds from 14.3.0-canary.77 and above
• Fixed versions: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7

Why it matters

This is an actively exploited, pre-authentication code execution path in one of the most widely deployed web stacks. Notably, when Cloudflare rolled out protections for React2Shell, the deployment caused an outage that disrupted some traffic. That incident is a reminder that urgent security updates must be rolled out carefully and in stages, not all at once.

What to do

1. Run npm audit or a dependency check to confirm you are not running vulnerable versions of React RSC or Next.js.
2. Upgrade to React 19.0.1 / 19.1.2 / 19.2.1 and to the patched Next.js versions that match what you run.
3. Treat any WAF protections around the application as a supplementary layer only. The primary fix is the patch, not rules.
4. In sensitive environments, consider targeted RCE testing after updating (a focused pen-test against the relevant endpoints).

Read more: 2.15M web services running Next.js exposed

---

Shared from the CSC - Cloud Security Community community, by Tohar Gueta.

Want more like this? Join the CSC - Cloud Security Community → https://youcc.co.il/community