Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution

Summary: A maximum-severity flaw in React Server Components, CVE-2025-55182 with a CVSS score of 10.0 and codenamed React2shell, allows unauthenticated remote code execution through unsafe deserialization of payloads sent to React Server Function endpoints. It affects React versions 19.0, 19.1.0, 19.1.1, and 19.2.0 and Next.js versions >=14.3.0-canary.77, >=15, and >=16, with fixes in React 19.0.1, 19.1.2, and 19.2.1 and Next.js 16.0.7, 15.5.7, 15.4.8, 15.3.6, 15.2.6, 15.1.9, and 15.0.5; researcher Lachlan Davidson reported it to Meta on November 29, 2025.
Key Takeaway: Wiz found 39% of cloud environments have instances vulnerable to this flaw, and Palo Alto Networks Unit 42's Justin Moore said more than 968,000 servers running React and Next.js have been identified, with no login and only network access needed to send a crafted HTTP request to a Server Function endpoint.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Mentions: CVE-2025-55182 CVE-2025-66478
Related: React Server Components remote code execution (React2Shell) Cyber Risks ·
How to detect React2Shell with Burp Suite Cyber Risks ·
Professional / Community 2025.10.7 Cyber Risks ·