Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
react-cve-2025-55182 — Detects and fixes CVE-2025-55182 (React2Shell) in React Server Components and Next.js apps. Scans package versions, suggests safe upgrades, and applies fixes via npm, yarn, or pnpm. | Kitploit
Tools/GitHubGitHub/amir-malek/react-cve-2025-55182
Vulnerability ScannersCode AnalysisWeb SecurityDevSecOpsSupply Chain SecurityLearning & Education
GitHubamir-malek/react-cve-2025-55182

react-cve-2025-55182

Detects and fixes CVE-2025-55182 (React2Shell) in React Server Components and Next.js apps. Scans package versions, suggests safe upgrades, and applies fixes via npm, yarn, or pnpm.

View Repository
29 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

fix-react2shell

A CLI tool to detect and fix the critical CVE-2025-55182 (React2Shell) vulnerability in React Server Components and Next.js applications.

The Vulnerability

CVE-2025-55182 is a critical (CVSS 10.0) unauthenticated remote code execution vulnerability affecting:

  • React Server DOM packages (versions 19.0.0, 19.1.0, 19.1.1, 19.2.0)
  • Next.js (versions 14.3.0-canary.77 through unpatched 15.x and 16.x)

The vulnerability is an unsafe deserialization flaw in the React Server Components Flight protocol. Exploitation requires only a crafted HTTP request, and public exploit code is available.

There is no workaround — upgrading to a patched version is required.

More Information

  • React Official Advisory
  • Next.js Security Advisory
  • Vercel Summary

Installation

Option 1: Run directly with npx

root@kitploit:~
npx @amirmalek/fix-react2shell

Option 2: Clone this repository

root@kitploit:~
git clone https://github.com/amir-malek/react-cve-2025-55182.git
cd react-cve-2025-55182
node fix-react2shell.js

Option 3: Download the script

root@kitploit:~
curl -O https://raw.githubusercontent.com/amir-malek/react-cve-2025-55182/main/fix-react2shell.js
node fix-react2shell.js

Usage

Navigate to your React/Next.js project directory and run:

root@kitploit:~
# Dry-run mode (default) - shows what would be upgraded
npx @amirmalek/fix-react2shell

# Actually perform the upgrades
npx @amirmalek/fix-react2shell --fix

# Show detailed version information
npx @amirmalek/fix-react2shell --verbose

# Show help
npx @amirmalek/fix-react2shell --help

Example Output

root@kitploit:~
╔══════════════════════════════════════════════════════════════╗
║        CVE-2025-55182 (React2Shell) Vulnerability Scanner    ║
╚══════════════════════════════════════════════════════════════╝

Package manager: yarn
Project: my-nextjs-app

⚠ Found 1 vulnerable package(s):

  ✗ next
    Current: 15.3.5 → Safe: 15.3.7

────────────────────────────────────────────────────────────
DRY RUN MODE - No changes made.
Run with --fix to upgrade packages.

Command that would be run:
  yarn add [email protected]

Features

  • Smart Detection — Only flags actually vulnerable versions, not all React 19 projects
  • Multi-Package Manager Support — Automatically detects and uses npm, yarn, or pnpm
  • Safe by Default — Runs in dry-run mode unless --fix is explicitly passed
  • Zero Dependencies — Uses only Node.js built-in modules
  • Portable — Works in any project directory

Vulnerable Versions

React Server DOM Packages

PackageVulnerableSafe
react-server-dom-webpack19.0.0, 19.1.0, 19.1.1, 19.2.019.0.1, 19.1.2, 19.2.1
react-server-dom-parcel19.0.0, 19.1.0, 19.1.1, 19.2.019.0.1, 19.1.2, 19.2.1
react-server-dom-turbopack19.0.0, 19.1.0, 19.1.1, 19.2.019.0.1, 19.1.2, 19.2.1

Next.js

BranchSafe Version
15.0.x15.0.5
15.1.x15.1.9
15.2.x15.2.6
15.3.x15.3.6
15.4.x15.4.8
15.5.x15.5.7
16.0.x16.0.7

After Upgrading

Once you have patched your versions and redeployed your application, it is strongly recommended to:

  1. Rotate all application secrets (API keys, database credentials, JWT secrets, etc.)
  2. Review application logs for any signs of prior exploitation
  3. Audit your infrastructure if you suspect compromise

License

MIT

Contributing

Issues and pull requests are welcome at github.com/amir-malek/react-cve-2025-55182.

Download Tool