Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-55182 — Detailed technical analysis of CVE-2025-55182 (React2Shell), a critical RCE vulnerability in React Server Components, including affected packages, exploitation mechanics, and patching guidance. | Kitploit
Tools/GitHubGitHub/mernjsb/cve-2024-55182
Vulnerability AnalysisExploitationWeb Application ExploitationPapers & ResearchLearning & Education
GitHubmernjsb/cve-2024-55182

CVE-2024-55182

Detailed technical analysis of CVE-2025-55182 (React2Shell), a critical RCE vulnerability in React Server Components, including affected packages, exploitation mechanics, and patching guidance.

View Repository
19 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-55182 (React2Shell) Vulnerablity

1. Explanation about the Vulnerablity:

CVE-2025-55182 (“React2Shell”) is a critical Remote Code Execution (RCE) vulnerability inside React Server Components (RSC) — specifically in the React Flight protocol deserialization logic.

Affects:

  • React’s server-side engine incorrectly parses data coming from the browser.

  • An attacker can send a specially crafted HTTP request to your server.

  • That request tricks React’s server runtime into executing arbitrary server-side JavaScript.

  • This allows attackers to:

    • Run commands on your server
    • Steal environment variables (API keys, database passwords, cloud credentials)
    • Install malware or cryptominers
    • Take full control of your backend

Outcomes:

  • No login required → attacker does not need an account
  • Works on default installations → even clean create-next-app builds
  • Works reliably as shown by researchers
  • Already exploited in the wild by cryptomining groups and credential thieves

    • If our site uses React 19 OR Next.js with the App Router, we must assume we are vulnerable until patched.

    2. What has been affected (all packages + versions)

    A complete, verified list of affected packages and versions:

    React packages (core issue)

    PackageVulnerable VersionsPatched Versions
    react-server-dom-webpack19.0.0, 19.1.0, 19.1.1, 19.2.019.0.1, 19.1.2, 19.2.1
    react-server-dom-parcelsame as abovesame as above
    react-server-dom-turbopacksame as abovesame as above

    These packages are tied to React Server Components (RSC) — the root cause.

    Frameworks / tools that bundle the vulnerable React server implementation

    These frameworks use RSC under the hood, so they inherited the vulnerability:

    Framework / ToolAffected?Notes
    Next.js (App Router)YesMost severely impacted. Vulnerability tracked as CVE-2025-66478 (now merged into CVE-2025-55182).
    Vite RSC PluginYesAny install using React Server Components.
    Parcel RSC PluginYesSame reason.
    React Router RSC PreviewYesBundles RSC server logic.
    RedwoodJS RSC (RedwoodSDK)YesUses RSC runtime.
    WakuYesExperimental RSC-based runtime.
    Any framework packaging the React 19 RSC serverYesMust check their advisories.

    3. How to secure our websites

    The official and complete security guidance for staying safe.

    A. Upgrade immediately (the ONLY full fix)

    If using React directly

    Upgrade to patched versions:

    root@kitploit:~
    "react-server-dom-webpack": "19.0.1" or "19.1.2" or "19.2.1"
"react-server-dom-parcel": "same"
"react-server-dom-turbopack": "same"

    Run:

    root@kitploit:~
    npm install react-server-dom-webpack@latest react-server-dom-parcel@latest react-server-dom-turbopack@latest

    If using Next.js (App Router)

    Upgrade to the patched Next.js versions:

    Major VersionSafe Version
    14.x (stable)Latest 14.x security release
    15.x15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7
    16.x16.0.7

    Run:

    root@kitploit:~
    npm install next@latest

    Alternative solution (Temporary fix and less Recommended by official documentation)

    B. If we cannot upgrade immediately (temporary mitigations)

    These do not fully fix the issue — but reduce exposure for a short time:

    Block malicious RSC/Flight requests at our WAF

    Block or rate-limit multipart/form-data POST requests to:

    • /app/
    • /actions
    • any RSC route handler

    Attackers rely on malformed multipart chunks to trigger the exploit.

    Download Tool