The React2Shell Vulnerability Explained
Introduction to React2Shell
The React2Shell Vulnerability
A major security flaw, nicknamed React2Shell, was discovered in React, one of the world's most popular tools for building websites and web applications. Officially tracked as CVE-2025-55182, this vulnerability affects a modern feature called React Server Components (RSC). RSC allows developers to run parts of their application on the server, which can make websites faster and more efficient.
The problem is that this vulnerability allows for remote code execution, or RCE. This is one of the most serious types of security flaws an application can have. It essentially gives an attacker a backdoor to the server running the website.
Remote Code Execution
noun
A type of vulnerability that allows an attacker to execute commands of their choosing on a remote machine over a network, such as the internet.
An RCE flaw means an unauthenticated attacker, anyone on the internet, could potentially take control of the server, access sensitive data, or disrupt services. Because no login or special access is required, it represents a critical threat.
A critical flaw in React’s Flight protocol (CVE-2025-55182) allows attackers to run code on servers using React Server Components.
Discovery and Disclosure
The vulnerability was identified by security researchers who were analyzing the 'Flight' protocol, the technology that powers React Server Components. Following standard industry practice, they privately disclosed their findings to the React development team at Meta.
This responsible disclosure gave the team time to understand the flaw, develop a fix, and prepare a patch before the vulnerability became public knowledge. Once the fixes were ready, the details of CVE-2025-55182 were released to the public, alerting developers worldwide to the urgent need to update their applications.
Within hours of the public announcement, security firms observed widespread scanning across the internet as attackers began searching for vulnerable systems.
Affected Applications
The React2Shell vulnerability specifically impacts applications that use React Server Components. This includes those built with modern versions of React and popular frameworks that build upon it, like Next.js.
Developers using these technologies were urged to check their project's dependencies to see if they were running a vulnerable version. The severity of the flaw meant that any public-facing application using these tools was a potential target.
| Framework | Vulnerable Versions |
|---|---|
| React | Versions using react-server-dom prior to 19.0.1, 19.1.2, or 19.2.1 |
| Next.js | Versions prior to 15.5.7 or 16.0.7 |
| Other RSC Frameworks | Any framework using the vulnerable underlying React packages |
This vulnerability received a high severity rating. The Common Vulnerability Scoring System (CVSS), an industry standard for rating the severity of vulnerabilities, assigned it a score reflecting its critical nature. The combination of being remotely exploitable without authentication and its high impact (total server compromise) makes it a top-tier threat.
What is the official identifier for the React2Shell vulnerability?
The React2Shell vulnerability is classified as what type of security flaw?