Vulnerability (CVE)
PortSwigger Research reports that React Server Components and Next.js carry critical remote code execution vulnerabilities tracked as CVE-2025-55182 (React) and CVE-2025-66478 (Next.js), with a CVSS score of 10.0. The flaw allows unauthenticated attackers...
PortSwigger released two updates on December 5, 2025, so that default scans in both versions of Burp Suite can detect React2Shell (CVE-2025-55182 and CVE-2025-66478) in Next.js applications without extensions, custom checks, or scripts. The two critical...
PortSwigger released Burp Suite Professional/Community 2025.10.7 on 8 December 2025, adding a new active scan check for React2Shell, a critical remote code execution vulnerability affecting React Server Components in React and Next.js, tracked as...
PortSwigger released Burp Suite Professional and Community 2025.11.3 on 8 December 2025, adding a new active scan check for React2Shell, a critical remote code execution vulnerability affecting React Server Components in React and Next.js, tracked as...
Unit 42 documented post-exploitation activity following exploitation of CVE-2025-55182, a CVSS 10.0 insecure deserialization flaw in the React Server Components Flight protocol disclosed Dec. 3, 2025, which allows unauthenticated attackers to execute...