nomorebreach/poc-cve-2025-55182POC for CVE-2025-55182 React2Shell
Severity: Critical (CVSS 10.0) Vulnerability Type: Remote Code Execution (RCE) via Deserialization Status: Patched (Dec 3, 2025) Advisory Source: NoMoreBreach.com
The NoMoreBreach research team highlights a critical vulnerability in React Server Components (RSC). Officially tracked as CVE-2025-55182, this flaw allows unauthenticated remote code execution on servers running vulnerable versions of React/Next.js.
If your infrastructure supports RSC—even if you do not explicitly use Server Actions—you are vulnerable.
The vulnerability exists in the serialization layer of react-server-dom-* packages. An attacker can craft a malicious HTTP request that, when processed by the server, bypasses authentication checks and executes arbitrary commands.
Affected Packages:
react-server-dom-webpack (v19.0.0 - v19.2.0)react-server-dom-parcel (v19.0.0 - v19.2.0)react-server-dom-turbopack (v19.0.0 - v19.2.0)Affected Frameworks:
There is no workaround. Patching is mandatory.
Upgrade to the patch version corresponding to your major release immediately:
| Version Line | Required Patch |
|---|---|
| Next.js 16.0.x | v16.0.7 |
| Next.js 15.5.x | v15.5.7 |
| Next.js 15.4.x | v15.4.8 |
| Next.js 15.3.x | v15.3.6 |
| Next.js 15.2.x | v15.2.6 |
| Next.js 15.1.x | v15.1.9 |
| Next.js 15.0.x | v15.0.5 |
npm install react@latest react-dom@latest react-server-dom-webpack@latest