React2Shell (CVE-2025-55182) Explained
Quick answer. React2Shell (CVE-2025-55182) let one unauthenticated request run code on servers using React Server Components, including Next.js App Router apps. Disclosed December 3, 2025, it was attacked within hours; checking deployed versions catches it, and patching closes it.
Video transcript
React2Shell let one unauthenticated request run code on servers using React Server Components, including Next.js App Router apps. It was rated 10, the maximum CVSS score.
React decoded payloads sent to Server Function endpoints unsafely, so malformed input was not validated correctly. No login or click was needed.
The flaw reached React's server packages, Next.js App Router apps and other frameworks built on them. Stable Next.js 13 and 14 were not affected.
Patches went public on December 3, and AWS saw exploitation attempts within hours. CISA added it to its Known Exploited Vulnerabilities catalog on December 5.
Wiz found vulnerable Next.js or React versions in 39 percent of cloud environments. Even a default Next.js production app was exploitable.
AWS saw reconnaissance commands, Wiz saw credential harvesting and cryptomining, and Security Alliance warned of drainers uploaded to legitimate crypto websites.
Guardian's November 2026 scan found only 2 of 74 version-visible crypto App Router sites still in range, 337 days after disclosure. That is a reason to check, not proof of a hole.
Check versions in every repository and upgrade to patched releases. If you were unpatched on December 4, rotate secrets. Search logs and look for unexpected processes and obfuscated scripts.
Guardian's Managed Security matches new disclosures against your systems in real time, and an engineer helps you patch. Read the full article, or talk to Guardian.
React is best known for code that runs in the browser. React2Shell was on the server, and it gave attackers code execution there.
It scored the maximum CVSS 10.0. According to Wiz, a default Next.js production app was exploitable without any code changes.
For crypto teams it reached users too. In December 2025, Security Alliance (SEAL) warned of "a big uptick in drainers uploaded to legitimate crypto websites" through the flaw.
What the Flaw Is
React Server Components run part of a React app on the server. Server Functions are endpoints the browser calls to run server code.
React decodes the payloads sent to those endpoints. NVD's record says the vulnerable code "unsafely deserializes payloads from HTTP requests to Server Function endpoints."
The React team wrote that an unauthenticated attacker could craft one HTTP request that achieves remote code execution.
Apps with no Server Functions could still be vulnerable if they supported React Server Components.
What was affected
- React: react-server-dom-webpack, -parcel and -turbopack at 19.0.0, 19.1.0, 19.1.1 and 19.2.0.
- Frameworks: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk.
- Next.js: App Router apps on 15.x, 16.x and 14.3.0-canary.77 or later.
- Not affected: Next.js 13.x, 14.x stable, the Pages Router and the Edge Runtime.
- Not affected: React code that does not run on a server.
How the Attack Works
Requests to Server Function endpoints carry payloads in React's RSC "Flight" format. Wiz places the flaw in how the server handles that format.
Wiz calls it a "logical deserialization vulnerability where the server processes RSC payloads in an unsafe manner." A malformed payload is not validated correctly.
Next.js says untrusted input could "influence server-side execution behavior." No login or user click is needed.
Next.js ships its own copy of React, so dependency tools could miss the flaw. Lachlan Davidson's site says that is why a second ID, CVE-2025-66478, was issued.
That ID was later rejected as a duplicate of CVE-2025-55182.
What attackers did with it
- Reconnaissance: AWS saw commands like whoami and id, test files in /tmp and reads of /etc/passwd.
- Credentials and mining: Wiz saw credential harvesting and cryptomining campaigns, with at least six incidents.
- Drainers: SEAL warned that drainers were being uploaded to legitimate crypto websites.
Exposure and Timeline
| Date | Event |
|---|---|
| Nov 29, 2025 | Lachlan Davidson reports it through Meta Bug Bounty |
| Dec 1 | Fix built; hosting providers start mitigations |
| Dec 3 | Patches and CVE published |
| Dec 3 to 4 | AWS sees exploitation attempts within hours |
| Dec 4 | Public exploits appear, per Vercel |
| Dec 5 | CISA adds it to the Known Exploited Vulnerabilities catalog |
| Dec 6 | Next.js urges apps unpatched on Dec 4 to rotate secrets |
| Dec 11 | React discloses denial of service and source exposure bugs |
| Dec 15 | Cointelegraph reports SEAL's drainer warning |
Researchers found the December 11 bugs while trying to exploit the first patch. React says the React2Shell fix still blocks code execution.
Wiz data showed vulnerable Next.js or React versions in 39% of cloud environments.
GreyNoise counted 95 IP addresses making largely automated attempts from 04:00 UTC on December 5, as cited by Wiz.
None of these sources gives a loss total, and SEAL gave no count of affected sites.
Crypto frontends
Guardian's November 2026 scan of 249 top crypto sites by TVL found 74 App Router sites with a visible version.
Only 2 of the 74 still ran a version in React2Shell's range, 337 days after disclosure.
A version in range is a reason to check, not proof of a hole. The full census is in our post on Next.js versions on crypto frontends.
What It Shows
- A frontend framework is a server. App Router apps on a server accept requests from anyone.
- Bundled copies hide exposure. Next.js vendored React, so package lists alone could mislead.
- WAF rules are a stopgap. Vercel says they "cannot guarantee protection against all possible variants of an attack."
- Patching is not the end. React's first denial of service fixes were incomplete and needed a second update.
Attacks began within hours. Our report on time to exploit in crypto tracks how fast disclosed flaws are attacked.
How to check your app
- Run npm ls next and npm ls react-server-dom-webpack in each repository.
- Upgrade React's server packages to 19.0.4, 19.1.5 or 19.2.4 or later.
- Upgrade Next.js to the patched release for your line, or run npx fix-react2shell-next.
- If the app was unpatched on December 4, 2025 at 1:00 PM PT, rotate its secrets.
- Search logs for POST requests with next-action or rsc-action-id headers, as AWS advises.
- Check servers for unexpected processes and file changes.
- Check your frontend for assets from unknown hosts and obfuscated scripts, as SEAL advises.
For rotation, see our guide to secrets management for crypto companies. The same year's Next.js middleware bypass is explained separately.
How Guardian Helps
Under Managed Security, Guardian ingests vulnerability disclosures in real time and matches them against your system.
Where one reaches you, an engineer confirms the exposure and works with you to patch it immediately.
Guardian's WebApp Pentest covers input handling: every parameter, tested by hand and fuzzed at scale, for injection and unsafe parsing.
It maps the application function by function at every privilege level. Source access is strongly recommended so nothing user-reachable is missed.
Frequently Asked Questions
What is React2Shell?
React2Shell is CVE-2025-55182, a CVSS 10.0 flaw in React Server Components disclosed on December 3, 2025. One crafted, unauthenticated HTTP request to a vulnerable server could run code on it.
Which versions does React2Shell affect?
React's server packages at 19.0.0, 19.1.0, 19.1.1 and 19.2.0, and Next.js 15.x, 16.x and 14.3.0-canary.77 or later on the App Router. Next.js 13.x, 14.x stable, Pages Router apps and the Edge Runtime were not affected.
Was React2Shell exploited?
Yes. AWS saw exploitation attempts within hours of disclosure, and CISA added it to its Known Exploited Vulnerabilities catalog on December 5, 2025. SEAL later warned of drainers planted on crypto websites through it.
Do I need to rotate secrets after patching?
Next.js advises it if your app was online and unpatched as of December 4, 2025 at 1:00 PM PT. Patch and redeploy first, then rotate, starting with your most critical secrets.
Sources
- React: Critical Security Vulnerability in React Server Components (December 3, 2025, updated January 26, 2026)
- React: Denial of Service and Source Code Exposure in React Server Components (December 11, 2025, updated January 26, 2026)
- NVD: CVE-2025-55182, with CISA Known Exploited Vulnerabilities entry (published December 3, 2025)
- Next.js: Security Advisory, CVE-2025-66478 (December 3, 2025)
- Vercel: React2Shell Security Bulletin (December 2025)
- AWS Security Blog: China-nexus Cyber Threat Groups Rapidly Exploit React2Shell Vulnerability (December 4, 2025)
- Wiz: React2Shell (CVE-2025-55182), Everything You Need to Know About the Critical React Vulnerability (December 3, 2025)
- Lachlan Davidson: React2Shell (December 2025)
- Cointelegraph: Hackers are exploiting a JavaScript library to plant crypto drainers (December 15, 2025)
- Guardian: Next.js Versions on Crypto Frontends, Known Critical Flaws (November 2026)
- Guardian: Managed Security
- Guardian: Web Application Penetration Testing
Know when an advisory reaches your stack
Guardian matches new disclosures like React2Shell against what you run, and pentests the web app and server behind your frontend.