React2Shell: Critical Security Vulnerability in React 19 and Next.js - What You Need to Do Now

On December 3, 2025, one of the most severe vulnerabilities in the history of the React ecosystem was disclosed. CVE-2025-55182, better known as "React2Shell", enables remote code execution (RCE) on servers using React Server Components. With a CVSS score of 10.0 - the highest possible - and active exploitation by state-sponsored hackers, immediate action is required.

What is React2Shell?

React2Shell is a critical vulnerability in the React Server Components (RSC) "Flight" protocol. The issue lies in insecure deserialization of data exchanged between client and server. An attacker can execute arbitrary code on your server without authentication.

Which Versions Are Affected?

The vulnerability affects a wide range of React and Next.js versions:

Active Exploitation in the Wild

Google has confirmed that at least five Chinese state-sponsored hacking groups are actively exploiting this vulnerability. North Korean and Iranian actors are also involved in the attacks.

How to Check If You Are Vulnerable

1. 1

   Check your React version

   Open package.json and check the react version. Versions 19.0.0-19.0.2, 19.1.0-19.1.3, and 19.2.0-19.2.2 are vulnerable.

2. 2

   Check your Next.js version

   Check the next version in package.json. All versions from 14.3.0-canary.77 up to the patched versions are affected.

3. 3

   Do you use Server Components?

   If you use the App Router with Server Components (default in Next.js 13+), you are likely vulnerable.

Immediate Actions

After the Upgrade: Rotate All Secrets

Because attackers may have already had access to your system, it is essential to rotate all secrets:

• Database passwords and connection strings
• API keys (Stripe, SendGrid, etc.)
• AWS/Azure/GCP credentials
• JWT secrets and session keys
• OAuth client secrets
• Environment variables with sensitive data

Additional CVEs

After the initial patch, two additional vulnerabilities were discovered:

Lessons for the Future

This vulnerability underscores the importance of proactive security management:

• Implement automatic security updates for dependencies
• Monitor security advisories from React and Next.js
• Use tools like Snyk or Dependabot for vulnerability scanning
• Keep an incident response plan ready
• Consider a Web Application Firewall (WAF) as an additional security layer

“Security is not a one-time action, but a continuous process. The React2Shell vulnerability shows how quickly critical issues can emerge in popular frameworks.”

Conclusion

React2Shell is a wake-up call for the JavaScript community. With CVSS 10.0 and active exploitation by state-sponsored hackers, this is not a vulnerability to ignore. Upgrade your applications today, rotate all secrets, and implement a structural security policy to be prepared for future threats.