React2Shell (CVE-2025-55182): Vercel Races to Patch a Critical Next.js RCE Flaw
Running Next.js? React2Shell (CVE-2025-55182) enables remote code execution. Here's how Vercel responded and what you need to patch right now.
Vulnerabilities
Critical React and Next.js RCE Vulnerability CVE-2025-55182 (CVSS 10.0): Who Is Affected and How to Patch
A critical flaw in React Server Components (CVE-2025-55182) enables unauthenticated remote code execution and scored a maximum CVSS 10.0. Patch now.
React Server Components: "It'll Be Secure," They Said...
If you're a frontend developer (or a full-stack developer who pretends to enjoy CSS), I hope you weren't counting on a quiet Friday. News of a critical vulnerability in the React ecosystem has spread across the industry, and it's the kind that makes every admin's hair stand on end.
We're talking about CVE-2025-55182. What makes it so frightening? It earned a rare and "prestigious" CVSS 10.0 score. Yes, on a scale that tops out at ten. That means it's bad. Very bad.
What's Going On? (For Technical and Non-Technical Readers)
The problem lies in React Server Components (RSC). In short, this mechanism deserializes data from untrusted sources (user input, for example) without proper validation. If you're thinking "that sounds like a textbook security hole," you're right.
An attacker can send a specially crafted HTTP request that the server will happily accept. Then, instead of rendering a component, the server executes the malicious code the attacker sent. This is full Remote Code Execution (RCE). It requires no privileges, no login, and no user interaction. The door is wide open.
Who Is Affected?
The list is specific and includes some of the most popular tools in use today:
- React: versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0.
- Next.js: versions 15.x and 16.x, plus Canary builds (above 14.3.0-canary.77).
- Packages such as
react-server-dom-parcel,react-server-dom-webpack, andreact-server-dom-turbopack.
If you run Next.js 15 or later with the App Router, you're in the crosshairs.
What Should You Do?
Don't panic (unless you haven't started updating yet). The library maintainers have risen to the occasion.
- Update React to version 19.0.1, 19.1.2, or 19.2.1.
- Update Next.js to the latest patched releases: 15.0.5, 15.1.9, 15.2.6, and so on (see the sources for the full list).
Good news for the procrastinators: if your app is hosted on Vercel, their team has already deployed WAF rules that block these attacks. But don't use that as an excuse. Update your packages!
See also: React2Shell: An In-Depth Technical Analysis - A deep dive into the deserialization mechanism and how this vulnerability can be exploited.
