React2Shell Part 1: Vulnerability Overview and Response Priorities

The React2Shell remote code execution (RCE) vulnerability in React Server Components (RSC), disclosed in December 2025, widely affected Next.js-based services.

1. CVE Summary

• CVE: CVE-2025-55182 – a vulnerability in React Server Components (RSC) / Flight deserialization. CVE-2025-66478 was reported on the Next.js side but has been merged as a duplicate of the above CVE.

• Description: A server-side remote code execution (RCE) vulnerability in Next.js / React Server Components (RSC) environments

• Severity (CVSS): CVSS 10.0 (Critical, server-side RCE possible) — a typical RCE where a successful attack can lead to shell execution, file access, DB queries, and even internal network scanning with the web server process’s privileges. Difficulty: initially high because it required understanding RSC internals, but decreasing as public analyses and PoCs appear.

• Priority: Added to KEV (2025-12-05) – officially classified as exploited in the wild. EPSS 77.80% (as of 2025-12-11, very high likelihood of exploitation)

• CWE: CWE-502 (Deserialization of Untrusted Data)

• Reporting and disclosure: 2025-11-29: researcher Lachlan Davidson first reported it to Meta (Facebook); 2025-12-03: official patch and React2Shell website released

2. Affected Versions

The vulnerability was confirmed in React 19.x and multiple Next.js canary and stable releases.

This is the affected range published by NVD. Be sure to check whether the React/Next.js versions used in your services fall within it.

3. Why This Vulnerability Is Dangerous

As the CVSS vector below shows, this is an RCE that lets an anonymous attacker on the network take over full server privileges with a single request.

As a result, the worst-case scenario becomes possible: confidential data leakage, data tampering, and service disruption.

From a practitioner’s perspective, this is a vulnerability that must be patched immediately with the highest priority.

CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• AV (Attack Vector) – N (Network): exploitable as long as the network (e.g., the internet) is reachable

• AC (Attack Complexity) – L (Low): easily exploitable without special conditions

• PR (Privileges Required) – N (None): anyone can attack without authentication

• UI (User Interaction) – N (None): no additional action needed from the victim

• S (Scope) – C (Changed): impact can extend beyond the vulnerable component → system-wide impact

• C (Confidentiality Impact) – H (High): sensitive information can be leaked

• I (Integrity Impact) – H (High): data can be modified or forged

• A (Availability Impact) – H (High): service outage/disruption possible

4. What to Do First

React2Shell enables RCE with a single request from the internet. Therefore, Next.js services exposed to the internet are the first targets.

After a PoC was published in December 2025, numerous automated tools and scanners probed Next.js/RSC endpoints worldwide in real time, so the response priority is clear.

✅ Priority 1: Update internet-facing services to patched versions first

The fastest and most effective response is to upgrade internet-facing services to patched versions first. Update React (react-server-dom-* packages) to 19.0.1, 19.1.2, 19.2.1 or later, and Next.js to the patched release for your version line (15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7) or later.

🔜 Next (Part 2): “How RSC and Flight Deserialization Led to Server RCE”

Part 2 analyzes how RSC/Flight deserialization led to RCE.

🔜 Next (Part 3): “After React2Shell: How Should Companies Rebuild Their Response Framework?”

Part 3 goes beyond simple scanning to explain what security framework organizations should build in light of this incident.

It covers why an SBOM/VEX-based response framework is necessary, and how companies can build response capabilities that hold steady when large-scale framework vulnerabilities recur.