React2Shell
- Product
- Meta React Server Components (react-server-dom-webpack / parcel / turbopack), Next.js App Router
- CVE
- CVE-2025-55182
- Disclosed
- 2025-12-03
- CVSS
- 10
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- React 19.0.0, 19.1.0, 19.1.1, 19.2.0 RSC packages; frameworks bundling them (Next.js 15.x / 16.x App Router, 14.3 canaries, Waku, React Router RSC, etc.)
- Fixed
- React 19.0.1, 19.1.2, 19.2.1; Next.js 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7
Summary
An unauthenticated attacker can send a single crafted HTTP request to any server that decodes React Server Components 'Flight' payloads (e.g. Next.js Server Actions) and get JavaScript code execution on the server. Default create-next-app projects were exploitable with no developer code involved. It was mass-exploited within days of disclosure.
Root cause
The RSC reply decoder (decodeReply) resolves string references such as "$1:a:b" by walking object properties without checking they are own properties. This lets a request reach inherited members like __proto__ and constructor, so an attacker-built fake 'chunk' object with a controlled then() is treated as a thenable during deserialization. The resulting gadget chain reaches the Function constructor and evaluates attacker-supplied code.
Impact
Full remote code execution as the Node.js server process on any internet-facing app using vulnerable RSC packages, including the default Next.js App Router template.
Detection
Look for POST requests carrying a Next-Action (or RSC) header with multipart bodies that contain reference strings like "$@", ":constructor:constructor" or "__proto__". Check package-lock / node_modules versions of react-server-dom-* and next. ProjectDiscovery nuclei and most commercial scanners ship CVE-2025-55182 checks.
Mitigation
Upgrade React RSC packages and the framework (Next.js, etc.) to the patched releases and redeploy; WAF rules from Vercel, Cloudflare and others are only a stopgap.