react2shell: a cvss 10 hole in react server components
An unauthenticated remote code execution flaw in React Server Components put Next.js App Router apps and other RSC frameworks at risk, and attackers moved within hours.
- cve
- CVE-2025-55182 (Next.js tracked it as CVE-2025-66478, since rejected)
- cvss
- 10.0 (v3.1, Meta CNA)
- affected
- react-server-dom-webpack / -parcel / -turbopack 19.0.0, 19.1.0, 19.1.1, 19.2.0; Next.js 15.x, 16.x, 14.3.0-canary.77+ (App Router)
- fixed in
- React 19.0.1 / 19.1.2 / 19.2.1 for the RCE (19.0.4 / 19.1.5 / 19.2.4 for all follow-up bugs); Next.js 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7
- exploited
- yes — added to CISA KEV 2025-12-05 (ransomware use: known)
- platforms
- server-side React apps using React Server Components (e.g. Next.js App Router)
what happened
- React disclosed CVE-2025-55182 on 2025-12-03: an unauthenticated remote code execution flaw in how React decodes payloads sent to React Server Function endpoints.[1,3]
- Affected packages are react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack in versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0; the first fixes shipped as 19.0.1, 19.1.2 and 19.2.1.[1,3]
- Meta, the CVE numbering authority, scored it 10.0 under CVSS v3.1, and NVD classes it as CWE-502 (deserialization of untrusted data).[3]
- React warned that an app may be vulnerable even if it implements no Server Function endpoints, as long as it supports React Server Components; affected frameworks and bundlers include next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk.[1]
- Next.js App Router apps on 15.x, 16.x and 14.3.0-canary.77 and later canaries were affected; Next.js 13.x, 14.x stable, Pages Router apps and the Edge Runtime were not.[2]
- AWS reported exploitation attempts from China-nexus groups including Earth Lamia and Jackpot Panda within hours of the 2025-12-03 disclosure.[5]
- CISA added CVE-2025-55182 to its Known Exploited Vulnerabilities catalog on 2025-12-05 with a 2025-12-12 due date, and lists known ransomware campaign use.[4,3]
- A follow-up React post (2025-12-11, updated 2026-01-26) disclosed denial-of-service bugs CVE-2025-55184, CVE-2025-67779 and CVE-2026-23864 (CVSS 7.5) and source-code exposure CVE-2025-55183 (CVSS 5.3); React says versions 19.0.4, 19.1.5 and 19.2.4 are safe.[6]
where sources differreact.dev lists the first affected version as "19.0" while NVD lists "19.0.0". Next.js published its own CVE-2025-66478; CISA's KEV entry notes it has since been rejected and associates it with CVE-2025-55182. The react.dev page's Next.js follow-up patch list is internally inconsistent (15.4.11 vs 15.4.10; 15.6.0-canary.60 vs .61) — check the Next.js advisory for exact builds.
sources6
- 01Critical Security Vulnerability in React Server Components ↗ primaryReact team (Meta)accessed 2026-10-21
- 02Security Advisory: CVE-2025-66478 ↗ primaryVercel / Next.jsaccessed 2026-10-21
- 03NVD CVE API record for CVE-2025-55182 ↗ primaryNIST NVDaccessed 2026-10-21
- 04CISA Catalog of Known Exploited Vulnerabilities (JSON feed, catalogVersion 2026.10.21) ↗ primaryCISAaccessed 2026-10-21
- 05China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) ↗ secondaryAWS Security Blogaccessed 2026-10-21
- 06Denial of Service and Source Code Exposure in React Server Components ↗ primaryReact team (Meta)accessed 2026-10-21