CVE-2025-55182: React Server Components Unsafe Deserialization Vulnerability
Overview
CVE-2025-55182 (also known as React2Shell) is a critical unsafe deserialization vulnerability discovered in the React Flight Protocol, affecting the payload of React Server Components (RSC). This vulnerability resides in the react-server package.
- CVE ID: CVE-2025-55182
- Vulnerability Type: Unsafe Deserialization
- Affected Components:
- React Flight Protocol
- React Server Components (RSC)
react-server package
- Affected Versions:
- React Server Components 19.0.0, 19.1.0, 19.1.1, 19.2.0
- Packages including
react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack
- Next.js 15.x/16.x versions using App Router
- Impact: Unauthenticated Remote Code Execution (RCE). An attacker can send a malicious payload to execute arbitrary code when the server processes it.
- Severity: Critical
- CVSS Score: 10.0 (maximum)
- Exploitation Status:
- Exploitable in default configurations of multiple popular frameworks, including Next.js, React Router, and Waku.
- Proof-of-concept (PoC) code is publicly available.
- Reports indicate active scanning in the wild, with exploitation by China-linked cyber threat groups.
- Disclosure Timeline:
- Discoverer: Lachlan Davidson
- Disclosed to React Team: November 29, 2025
- Public Disclosure: December 3, 2025
- Mitigation:
- Immediate Patching: All developers using React Server Components are strongly advised to upgrade affected packages to patched versions immediately.
- CISA: This CVE has been added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities Catalog.
- No Workaround: No known temporary workaround is available.
References
- This PoC implementation mainly references the following materials:
robbin0919/cve-2025-55182
