React2Shell (CVE-2025-55182): Vercel Races to Patch a Critical Next.js RCE Flaw

Happy Sunday! We hope your weekend is going smoothly. But if you're a developer working with Next.js, this morning may call for a double espresso. Things have heated up in cybersecurity because of a new vulnerability with a catchy but chilling name: "React2Shell" (CVE-2025-55182). As we reported earlier, the flaw received the maximum CVSS score of 10.0. This is not one to downplay.

What's going on?

In short, the bug is in React Server Components, and it affects applications built on Next.js. Framework versions 15.0.0 through 16.0.6 are vulnerable. If your application runs on any of them, you're a target.

The situation is serious. According to Vercel, public exploits (proofs of concept) are already circulating, and the first scans and attack attempts have shown up in logs. "React2Shell" is no joke. As the name suggests, attackers can get shell access through remote code execution (RCE), which is a nightmare scenario for any admin.

Vercel's response: shield and sword

Credit where it's due: the Vercel team moved fast. Before the CVE was even publicly disclosed, the company had already deployed rules on its WAF (Web Application Firewall) that block known attack patterns. Vercel also:

• Blocked new deployments for projects running vulnerable versions of Next.js.
• Released a quick-fix tool: npx fix-react2shell-next.
• Shared its findings with other CDN and WAF providers to protect the wider community.

All of these measures are defense in depth, but keep in mind that a WAF is only a band-aid. The only real cure is updating your packages. Interestingly, this vulnerability also played a part in the recent Cloudflare outage. While Cloudflare was changing its WAF rules in response to React2Shell, a cascading failure took down 28% of the internet.

Bug hunting (and bounties)

Vercel is confident enough in its defenses, or determined enough to harden them, that it has partnered with HackerOne. The company is paying serious money to anyone who finds a way around its protections for this specific CVE:

• USD 25,000 for high-severity findings.
• USD 50,000 for critical findings.

So if you have a free afternoon and a knack for breaking security controls, you might want to give it a shot.

What you need to do RIGHT NOW

Don't assume you'll be fine just because your startup is small. Bots don't discriminate.

1. Check your Next.js version: Look in package.json, or type next.version into the browser console on your site.
2. Update: If you're on any version from 15.0.0 to 16.0.6, upgrade to a patched release immediately.
3. Monitor: Vercel recommends checking your logs for unusual POST requests. It also notes that function timeouts alone don't necessarily mean an attack succeeded, since they may just be scans.

Vercel customers will see a dedicated banner on their dashboard showing whether their production deployment is at risk. Treat it as a red warning light.

Takeaways: When "Zero-Day" Stops Being a Digital Myth

CVE-2025-55182 is an unpleasant reminder that even code written by some of the world's best engineers, and backed by Meta and Vercel, can contain fundamental flaws.

Background: Zero-Day Vulnerabilities: The Invisible Weapon - An in-depth look at zero-days, from their technical anatomy and the black market to defense strategies.

Code safely, and despite everything, enjoy the rest of your weekend!

Aleksander

Sources: Vercel Blog - Resources for protecting against 'React2Shell'