CVE-2025-55182 - React RSC RCE

PoC for the deserialization vulnerability in the Flight protocol of React Server Components.

What is it?

Next.js 14+ and React 19 use a proprietary protocol ("Flight") to communicate between client and server. The problem: the server loads any module without verification. So we can make it execute child_process and boom, RCE.

Usage

python CVE-2025-55182.py -t <IP> -p <PORT> --cmd "id"

Affected Versions

• Next.js < 14.2.21
• Next.js < 15.1.2
• React < 19.2.1

Fix

Update your dependencies. That's it.

Disclaimer

For use only on systems you own or with written authorization. I am not responsible if you do something stupid.