SECURELYN
Free ScanFree consultation

React Server Components remote code execution (CVE-2025-55182, React2Shell)

CVE-2025-55182, widely called React2Shell, is a critical remote code execution vulnerability in React Server Components. An unauthenticated attacker could send a crafted request to a vulnerable server and run code on it.

Check if you are exposedTalk to an expert

Automated summary, not yet reviewed by a Securelyn engineer

Who should care

Teams that build or buy web applications with React Server Components, and the people who host them. If your site is built with Next.js or a similar framework, ask your developer which React version it uses.

What to do

  1. Check the React and framework versions you run against the official React and framework advisories.
  2. Upgrade to the patched versions named in those advisories.
  3. Review logs for unexpected requests to server function endpoints.
  4. If you cannot patch at once, ask your host or web application firewall provider about interim protections.

Always confirm affected and fixed versions in the official advisories before you act.

What is affected

Applications that use React Server Components, including frameworks built on them such as the Next.js App Router, when they run an affected React version. The affected and fixed versions are named in the official React and framework advisories.

Is it being exploited?

CISA KEV
Not in our offline sample: check the CISA catalogue.
EPSS
Not in our offline sample: check the CISA catalogue.

References