CVE-2025-55182 (React2Shell) Vulnerablity

1. Explanation about the Vulnerablity:

CVE-2025-55182 (“React2Shell”) is a critical Remote Code Execution (RCE) vulnerability inside React Server Components (RSC) — specifically in the React Flight protocol deserialization logic.

Affects:

• React’s server-side engine incorrectly parses data coming from the browser.

• An attacker can send a specially crafted HTTP request to your server.

• That request tricks React’s server runtime into executing arbitrary server-side JavaScript.

• This allows attackers to:

  • Run commands on your server
  • Steal environment variables (API keys, database passwords, cloud credentials)
  • Install malware or cryptominers
  • Take full control of your backend

Outcomes:

• No login required → attacker does not need an account
• Works on default installations → even clean create-next-app builds
• Works reliably as shown by researchers
• Already exploited in the wild by cryptomining groups and credential thieves

If our site uses React 19 OR Next.js with the App Router, we must assume we are vulnerable until patched.

---

2. What has been affected (all packages + versions)

A complete, verified list of affected packages and versions:

React packages (core issue)

Package	Vulnerable Versions	Patched Versions
react-server-dom-webpack	19.0.0, 19.1.0, 19.1.1, 19.2.0	19.0.1, 19.1.2, 19.2.1
react-server-dom-parcel	same as above	same as above
react-server-dom-turbopack	same as above	same as above

These packages are tied to React Server Components (RSC) — the root cause.

---

Frameworks / tools that bundle the vulnerable React server implementation

These frameworks use RSC under the hood, so they inherited the vulnerability:

Framework / Tool	Affected?	Notes
Next.js (App Router)	Yes	Most severely impacted. Vulnerability tracked as CVE-2025-66478 (now merged into CVE-2025-55182).
Vite RSC Plugin	Yes	Any install using React Server Components.
Parcel RSC Plugin	Yes	Same reason.
React Router RSC Preview	Yes	Bundles RSC server logic.
RedwoodJS RSC (RedwoodSDK)	Yes	Uses RSC runtime.
Waku	Yes	Experimental RSC-based runtime.
Any framework packaging the React 19 RSC server	Yes	Must check their advisories.

---

3. How to secure our websites

The official and complete security guidance for staying safe.

---

A. Upgrade immediately (the ONLY full fix)

If using React directly

Upgrade to patched versions:

"react-server-dom-webpack": "19.0.1" or "19.1.2" or "19.2.1"
"react-server-dom-parcel": "same"
"react-server-dom-turbopack": "same"

---

Run:

npm install react-server-dom-webpack@latest react-server-dom-parcel@latest react-server-dom-turbopack@latest

---

If using Next.js (App Router)

Upgrade to the patched Next.js versions:

Major Version	Safe Version
14.x (stable)	Latest 14.x security release
15.x	15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7
16.x	16.0.7

Run:

npm install next@latest

---

---

Alternative solution (Temporary fix and less Recommended by official documentation)

B. If we cannot upgrade immediately (temporary mitigations)

These do not fully fix the issue — but reduce exposure for a short time:

Block malicious RSC/Flight requests at our WAF

Block or rate-limit multipart/form-data POST requests to:

• /app/
• /actions
• any RSC route handler

Attackers rely on malformed multipart chunks to trigger the exploit.