CVE-2025-55182: React Server Components Flight 프로토콜 역직렬화 원격 코드 실행 (React2Shell)

Last verified: 2026-11-04 (KST). Each figure is listed only if confirmed from the sources in the References below; where values differ between sources, all are listed together.

📌 TL;DR

• What: In the deserialization process of React Server Components (RSC)'s Flight protocol, property names in reference paths are not validated, allowing an attacker to traverse the prototype chain to reach the Function constructor and execute arbitrary JavaScript.
• Where: react-server-dom-webpack / -parcel / -turbopack 19.0.0, 19.1.0, 19.1.1, 19.2.0 and frameworks using them — most notably Next.js 15.x / 16.x App Router. Even if you do not define Server Functions directly, you are affected as long as you support RSC.
• How dangerous: RCE with a single HTTP request without authentication (CVSS 10.0). Within hours of disclosure, a China-linked group began exploiting it, and it is listed in CISA KEV and marked "Known" for ransomware exploitation.

📋 Basic Information

항목	내용
CVE ID	CVE-2025-55182 (React) / Next.js용 CVE-2025-66478은 중복으로 거부(Rejected) 됨
별칭	React2Shell
공개일	2025-12-03 (React 팀 권고, 같은 날 패치 배포)
발견자	Lachlan Davidson (2025-11-29 Meta Bug Bounty로 제보)
영향 제품/버전	react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack 19.0.0, 19.1.0, 19.1.1, 19.2.0 / Next.js 14.3.0-canary.77 이상 canary, 15.x, 16.x (App Router)
패치 버전	RCE 수정: React 19.0.1 / 19.1.2 / 19.2.1, Next.js 15.0.5 / 15.1.9 / 15.2.6 / 15.3.6 / 15.4.8 / 15.5.7 / 16.0.7 권장 최종 버전(후속 취약점 포함): React 19.0.3 / 19.1.4 / 19.2.3 (아래 "후속 취약점" 참조)
CVSS v3.1	10.0 Critical — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0	본 문서 작성 시점에 1차 출처에서 확인하지 못함
CWE	CWE-502 Deserialization of Untrusted Data (Vercel GHSA-9qr9-h5gf-34mp, GitLab Advisory DB). CISA KEV 항목에는 CWE 미기재
실제 악용 여부	악용 확인. CISA KEV 등재 2025-12-05, 연방기관 조치 기한 2025-12-12, 랜섬웨어 캠페인 사용: Known. AWS는 공개 수 시간 내 악용 시도 관측

Affected Scope Details

Component	Affected Versions	Fixed Versions
react-server-dom-webpack / -parcel / -turbopack	19.0.0	19.0.1 (19.0.3 recommended)
〃	19.1.0, 19.1.1	19.1.2 (19.1.4 recommended)
〃	19.2.0	19.2.1 (19.2.3 recommended)
Next.js 15.x (App Router)	Before 15.0 ~ 15.5 patches	15.0.5 / 15.1.9 / 15.2.6 / 15.3.6 / 15.4.8 / 15.5.7
Next.js 16.x (App Router)	Below 16.0.7	16.0.7
Next.js canary	14.3.0-canary.77 and above	15.6.0-canary.58 / 16.1.0-canary.12 (14.3 canary users should downgrade to 14.x stable)
Other RSC integration tools	React Router (unstable RSC API), Waku, Parcel RSC plugin, Vite RSC plugin (@vitejs/plugin-rsc), RedwoodSDK, Expo, etc.	Latest version of each tool + patched react-server-dom-*

영향 없음: 서버를 쓰지 않는 순수 클라이언트 React 앱, Next.js 13.x / 14.x stable, Pages Router 앱, Edge Runtime 배포.

Follow-up Vulnerabilities (Caution When Determining Patched Versions)

After the React2Shell patch, additional research on RSC led to a series of vulnerabilities being disclosed that are not RCE. The RCE itself was fixed in 19.0.1 / 19.1.2 / 19.2.1, but the latest version is required to also block the vulnerabilities below.

CVE	Type	CVSS v3.1	Published	Fixed Version
CVE-2025-55184	Denial of Service (DoS)	7.5	2025-12-11	19.0.2 / 19.1.3 / 19.2.2 (incomplete)
CVE-2025-55183	Source code exposure	5.3	2025-12-11	19.0.2 / 19.1.3 / 19.2.2
CVE-2025-67779	DoS caused by the incomplete patch for CVE-2025-55184	7.5	2025-12-12	19.0.3 / 19.1.4 / 19.2.3

Some security vendor posts (e.g., the Zscaler update) state that "the original patch for CVE-2025-55182 was incomplete." However, according to the React and GitLab advisories, what was incomplete was the DoS fix (CVE-2025-55184), and we could not confirm a primary source stating that the RCE fix was bypassed. Either way, the recommended action is to upgrade to 19.0.3 / 19.1.4 / 19.2.3 or later.

Key Dates

Date	Event
2025-11-29	Reported by Lachlan Davidson via the Meta Bug Bounty program
2025-11-30	Confirmed by Meta security researchers; remediation started with the React team
2025-12-03	React advisory and patches (19.0.1 / 19.1.2 / 19.2.1) and the Next.js advisory (CVE-2025-66478) published. Cloud and WAF vendors received advance notice and deployed protection rules
2025-12-03 ~ 04	AWS observed exploitation attempts by China-linked groups (Earth Lamia, Jackpot Panda) within hours of disclosure. Zscaler observed more than 4,100 exploitation attempts in the first 2 hours
2025-12-05	Added to CISA KEV (deadline 12-12). Microsoft detected actual exploitation activity starting this day
2025-12-11	Follow-up vulnerabilities CVE-2025-55184 / 55183 published
2025-12-12	CVE-2025-67779 (incomplete patch) published; 19.0.3 / 19.1.4 / 19.2.3 released
2025-12-15	Microsoft published post-exploitation analysis and a hunting guide

🔍 Root Cause Analysis

1. Background: the Flight protocol and chunks

RSC exchanges data between client and server using its own serialization protocol called Flight. When a client calls a Server Function, the browser sends the arguments as a multipart/form-data POST request, and each form field becomes a numbered chunk.

• Types are expressed with string prefixes. For example: $<id> references the value of another chunk, $@<id> references the chunk object itself, and $B<id> handles Blobs.
• A chunk is a thenable object with a then() method. When JavaScript's await encounters a thenable, it calls then(), and if the result is another thenable, it keeps calling recursively.

2. What: unvalidated property traversal in getOutlinedModel()

The server-side Flight response handler (packages/react-server/src/ReactFlightReplyServer.js)'s getOutlinedModel() splits references of the form $<id>:<prop1>:<prop2> on :, then follows properties on the target chunk in the order chunk[prop1][prop2].

At this point, it did not verify whether the property name was an own property of the object. As a result, it was possible to access inherited properties via names such as __proto__, constructor, and prototype.

3. Why: reaching dangerous objects via the prototype chain (CWE-502)

In JavaScript, constructor.constructor of any object is the global Function constructor, which takes a string and creates an executable function. According to public analyses (OPSWAT, Zscaler), attackers combine the following two elements.

Element	Exploitation method (concept)
Prototype traversal	Access internal methods (Chunk.prototype.then) and the Function constructor via reference paths
Recursive then() resolution	An attacker-crafted fake chunk is treated as a thenable, and the deserialization engine trusts its state as-is
$B (Blob) handler	Intercepts the method call path of the internal response object and induces it to pass attacker code to the Function constructor

4. How: executed before authentication