Status at WZ-IT: We have already updated all customer systems under our management to patched versions. With this post, we want to help spread awareness about the urgency of this vulnerability so that as many systems as possible get patched quickly.
Update of 12 October 2026: While reviewing the React2Shell patches, researchers found further flaws in the RSC protocol that do not allow code execution: CVE-2025-55184 and CVE-2025-67779 (denial of service, CVSS 7.5), CVE-2025-55183 (exposure of Server Function source code, CVSS 5.3), in January 2026 CVE-2026-23864, in April and May 2026 CVE-2026-23869 and CVE-2026-23870, and in July 2026 CVE-2026-44907 (all DoS, CVSS 7.5). The minimum fixed React versions are now 19.0.8, 19.1.9 and 19.2.8 (affected by CVE-2026-44907: 19.0.0-19.0.7, 19.1.0-19.1.8, 19.2.0-19.2.7). For Next.js, the advisory of December 11, 2025 lists, among others, 14.2.35, 15.5.9 and 16.0.10; further Next.js security releases have followed since. Keep the latest patch release of your release line in place. CVE-2025-55182 has been in the CISA Known Exploited Vulnerabilities catalog since December 5, 2025.
On December 3, 2025, one of the most severe security vulnerabilities in recent years was disclosed in the JavaScript ecosystem: CVE-2025-55182, also known as React2Shell. With a CVSS score of 10.0 (maximum), this is a critical Remote Code Execution (RCE) vulnerability affecting millions of web applications.
If you're using Next.js or React Server Components: Stop everything else and patch immediately.
Table of Contents
- What is React2Shell?
- Technical Details
- Affected Versions
- Patched Versions
- Active Exploitation
- Immediate Actions
- Am I Affected?
- WAF Protection Is Not Enough
- Conclusion
- Sources
What is React2Shell?
React2Shell is an Unsafe Deserialization Vulnerability in React Server Components. The vulnerability was discovered by security researcher Lachlan Davidson and reported to the Meta team on November 29, 2025.
The problem lies in the Flight Protocol – the serialization format that React Server Components use for communication between server and client. Due to improper validation of incoming payloads, attackers can execute arbitrary code on the server.
Critical: Standard Next.js applications created with
create-next-appare vulnerable without any code changes.
Technical Details
The vulnerability affects the deserialization logic in React Server Components:
- CVE-2025-55182: The main vulnerability in React Server Components
- CVE-2025-66478: The specific manifestation in Next.js
When a server receives a specially crafted, malformed payload, the structure is not correctly validated. This allows attacker-controlled data to influence server-side execution logic – resulting in the execution of privileged JavaScript code.
Affected packages:
react-server-dom-webpackreact-server-dom-parcelreact-server-dom-turbopack
Affected frameworks:
- Next.js (App Router)
- React Router (with RSC)
- Waku
- @parcel/rsc
- @vitejs/plugin-rsc
- rwsdk
Affected Versions
React Server Components
| Affected Version | Patched Version |
|---|---|
| 19.0.0 | 19.0.1 |
| 19.1.0, 19.1.1 | 19.1.2 |
| 19.2.0 | 19.2.1 |
Next.js
| Affected Version | Patched Version |
|---|---|
| 15.0.x | 15.0.5 |
| 15.1.x | 15.1.9 |
| 15.2.x | 15.2.6 |
| 15.3.x | 15.3.6 |
| 15.4.x | 15.4.8 |
| 15.5.x | 15.5.7 |
| 16.0.x | 16.0.7 |
Canary versions:
- Next.js 14 canaries from 14.3.0-canary.77 → Downgrade to the latest stable 14.x release (
npm install next@14, per the Next.js advisory) - Next.js 15 canaries before 15.6.0-canary.58 → Upgrade to 15.6.0-canary.58
- Next.js 16 canaries before 16.1.0-canary.12 → Upgrade to 16.1.0-canary.12
Patched Versions
React: 19.0.1, 19.1.2, 19.2.1
Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7
Active Exploitation
The vulnerability is being actively exploited.
According to the AWS Security Blog, Amazon Threat Intelligence Teams observed active exploitation attempts within hours of disclosure on December 3, 2025, by multiple state-sponsored groups, including:
- Earth Lamia (China-nexus)
- Jackpot Panda (China-nexus)
Wiz Research reports that 39% of all cloud environments contain instances of Next.js or React in vulnerable versions. More than 968,000 servers have been identified as potentially vulnerable.
Immediate Actions
1. Check Version
# In browser developer tools on a page of your app:
next.version
# Or check package.json
cat package.json | grep next
2. Automatic Patching (Next.js)
Vercel has provided an npm package:
npx fix-react2shell-next
3. Manual Update
# For Next.js 15.5.x
npm install [email protected]
# For Next.js 16.0.x
npm install [email protected]
# Update React
npm install [email protected] [email protected]
4. Redeploy
After updating, you must redeploy your application. A simple server restart is not sufficient.
5. Check Logs
Review your application logs for:
- Unusual POST requests
- Spikes in function timeouts
- Suspicious activity
Am I Affected?
You are affected if:
- ✅ You use Next.js with App Router on an unpatched 15.x or 16.0.x release (up to 16.0.6) or on 14.3.0-canary.77 or later
- ✅ You use React Server Components in an affected version
- ✅ Your application uses server-side React components
You are NOT affected if:
- ❌ You only use client-side React without a server
- ❌ You don't use a framework/bundler with React Server Components support
- ❌ You use Next.js Pages Router (without App Router)
- ❌ You use Next.js 14.x (stable version) without canary features
Quick Test
Run in the browser console on a page of your app:
next.version
Compare the result with the affected versions above.
WAF Protection Is Not Enough
Vercel, Cloudflare, AWS, Akamai, Fastly, and Google Cloud have deployed WAF rules that block known exploit patterns. However:
WAF rules are only an additional layer of defense. They cannot block all possible variants of an attack. Upgrading to a patched version is the only complete solution.
Since December 5, 2025, Vercel also blocks new deployments of projects with vulnerable Next.js versions.
Conclusion
CVE-2025-55182 (React2Shell) is one of the most critical vulnerabilities ever to hit the JavaScript ecosystem:
- CVSS 10.0 – Maximum Severity
- Remote Code Execution without authentication
- Active exploitation by state actors
- Millions of affected applications
Act now:
- Check your Next.js/React version
- Update to a patched version
- Redeploy your application
- Review your logs for suspicious activity
The good news: Patches are available and the update is straightforward in most cases.
Our Support
Unsure if your systems are affected, or need help patching? WZ-IT can help:
- Rapid security audits of your web infrastructure
- Patch management and deployment support
Sources
- Vercel Blog: Resources for protecting against 'React2Shell'
- React.dev: Critical Security Vulnerability in React Server Components
- AWS Security Blog: China-nexus cyber threat groups rapidly exploit React2Shell vulnerability
- Wiz Blog: Critical RCE Vulnerabilities Discovered in React & Next.js
- Tenable: React2Shell RCE (CVE-2025-55182)
- Datadog Security Labs: CVE-2025-55182 (React2Shell)
- Help Net Security: Max-severity vulnerability in React, Node.js patched
- The Hacker News: Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution
- Rapid7: React2Shell, Critical unauthenticated RCE affecting React Server Components
- react2shell.com
- React.dev: Denial of Service and Source Code Exposure in React Server Components
- Next.js Security Update: December 11, 2025
- Next.js: Security Advisory CVE-2025-66478
- React: GHSA-wx67-qw84-cm4g / CVE-2026-44907 (Denial of Service in Server Functions)
- CISA: Known Exploited Vulnerabilities Catalog
