# CVE-2025-55182 React2Shell Unauthenticated RCE in React Source: https://www.egnworks.com/blog/cve-2025-55182-react2shell-unauthenticated-rce-in-react Author: Jacob Strix Published: 2026-06-20 Updated: 2026-06-20 Category: Security Tags: CVE-2025-55182, React, React Server Components, Authentication, RCE, Deserialization > How CVE-2025-55182 React2Shell turns a React Server Components request into unauthenticated RCE and how to patch it fast. --- React Server Components shipped a maximum severity flaw that turns a single HTTP request into remote code execution. CVE-2025-55182 known as React2Shell lives in the Flight protocol deserializer and it needs no authentication and no special configuration. A default Next.js build is enough to be exploitable. State linked groups began exploiting it within hours of disclosure on December 3 2025 and CISA added it to the Known Exploited Vulnerabilities catalog two days later. If you run React 19 or Next.js 15 or 16 you should patch right now. ## What is React2Shell and Why This Matters React Server Components let the server send a serialized component tree to the browser over a wire format called the Flight protocol. That protocol has its own deserializer and that deserializer is the problem. Any application that supports React Server Components is in scope. You do not need to write a server action or a custom endpoint. The 2024 State of JavaScript survey put React in the hands of more than eight in ten developers so the blast radius is enormous. A single unauthenticated request reaches code execution on a host that usually holds cloud credentials and database secrets and internal tokens. ## Quick Facts **CVE ID:** `CVE-2025-55182` **Also known as:** `CVE-2025-66478 (Next.js)` **Published:** `December 3 2025` **CVSS 3.1:** `10.0 Critical | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` **CWE:** `CWE-502 Deserialization of Untrusted Data` **Affected versions:** `React 19.0.0 through 19.2.0 and Next.js 15.x and 16.x` **Authentication required:** `None` **CISA KEV:** `Added December 5 2025 with deadline December 26 2025` **Exploitation in wild:** `Confirmed within hours of disclosure` **Fix:** `Upgrade to patched React and Next.js then rebuild` ## Root Cause The Flight protocol encodes values as chunks and it supports references between them. A reference looks like a dollar sign followed by an id and an optional path. The deserializer resolves these references by walking properties on already decoded values. The flaw is that it never restricts which properties it will walk. An attacker can send a chunk that references its own prototype chain. Two reference paths do the damage. The tokens below are written with markers so this post does not ship a working exploit. PROTO marks the prototype accessor and CTOR marks the constructor accessor. ```bash $1:[PROTO]:then $1:[CTOR]:[CTOR] ``` The first path walks to the prototype and grabs the then property which lets the attacker forge a thenable that React will await. The second path walks from a value to its constructor and then to that constructor own constructor which is the JavaScript Function constructor. Once an attacker can reach Function they can compile a string into a function and the deserializer calls it. Untrusted input reaches a code interpreter with no sandbox. Because deserialization happens before any routing or authentication the request never touches your application logic. ## How the Exploit Works The attacker sends one POST request with a forged Flight chunk in a multipart body. The chunk pretends to be a resolved model so the deserializer starts resolving it. The malicious code rides in a field that gets handed to the Function constructor. The payload below keeps the markers from the previous section and uses a command placeholder rather than a working payload. ```bash POST / HTTP/1.1 Host: target:3000 Content-Type: multipart/form-data; boundary=----abc123 Accept: text/x-component Next-Action: react2shell ------abc123 Content-Disposition: form-data; name="0" {"then":"$1:[PROTO]:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"[RCE_COMMAND]","_formData":{"get":"$1:[CTOR]:[CTOR]"}}} ------abc123-- ``` The forged object claims status resolved_model so the Flight runtime treats it as genuine. The PROTO reference builds a fake thenable. The CTOR reference reaches Function. The _prefix field carries the command and in a real attack it invoked the Node child process facility to run reverse shells and credential stealers that read environment variables and cloud metadata. ## Real World Exploitation This was never theoretical. Shadowserver counted more than seventy seven thousand exposed and vulnerable hosts. Within hours of the December 3 disclosure honeypots recorded China nexus groups including Earth Lamia and UNC5174 probing and refining payloads against live targets. Reported post exploitation included Cobalt Strike beacons Sliver implants Fast Reverse Proxy and a wave of coin miners. CISA added the flaw to its Known Exploited Vulnerabilities catalog on December 5 with a federal remediation deadline of December 26. The gap between disclosure and mass exploitation was measured in hours not days. ## Are You Affected Any build that bundles a vulnerable React Server Components runtime is in scope even if you never wrote server code. Check your installed versions first. ```bash npm ls react react-dom next ``` If you see React 19.0.0 through 19.2.0 or an unpatched Next.js 15 or 16 you are vulnerable. You can also probe an instance safely by watching how it answers a Flight style request without sending any code. ```bash curl -s -o /dev/null -w "%{http_code}\n" -X POST 'https://YOUR-HOST/' -H 'Accept: text/x-component' ``` After that review access logs for POST bodies that reach into the prototype chain or the constructor chain or that try to load the Node child process facility. Those patterns have no place in a legitimate Flight payload. ## The Patch and Why It Matches the Exploit The fix lands in the patched React releases and the matching Next.js versions. The deserializer no longer follows references into prototype or constructor chains so there is no path from a forged chunk to the Function constructor. Upgrade is the only complete fix. ```bash npm install react@^19.2.1 react-dom@^19.2.1 next@^16.0.7 ``` Vercel also shipped a helper that detects and upgrades vulnerable versions across a workspace. ```bash npx fix-react2shell-next ``` Then clear caches and rebuild so no vulnerable copy survives transitively. ```bash rm -rf node_modules .next package-lock.json npm install npm run build ``` A WAF rule that blocks forged Flight payloads buys time but it does not replace the upgrade. If a host was exposed assume compromise and rotate every credential it could reach. ## Timeline **November 29 2025:** Researcher Lachlan Davidson reports the flaw to Meta. **December 3 2025:** Public disclosure and patches ship. Exploitation begins within hours. **December 4 2025:** First public proof of concept appears. **December 5 2025:** CISA adds CVE-2025-55182 to the KEV catalog. **December 26 2025:** Federal remediation deadline. ## Lessons The deeper lesson is that a serializer is an attack surface. The Flight protocol was built to move trusted server data to the browser yet it accepted attacker controlled input and walked it without limits. The moment a deserializer can reach the Function constructor the format becomes a code interpreter. This is the same shape as an unauthenticated server side template or eval flaw where attacker data reaches a code path it was never meant to touch. Treat every wire format that crosses a trust boundary as untrusted and never let it traverse arbitrary properties. ## Related Reading [Detecting Prompt Injection With Your SIEM](https://www.egnworks.com/blog/detecting-prompt-injection-with-your-siem) [Hunting LOLBins in Your SIEM With Sysmon and Sigma](https://www.egnworks.com/blog/hunting-lolbins-in-your-siem-with-sysmon-and-sigma) [CVE-2026-33017 Unauthenticated RCE in Langflow and the 20 Hour Exploit](https://www.egnworks.com/blog/cve-2026-33017-unauthenticated-rce-in-langflow-and-the-20-hour-exploit) ## References [React Security Advisory for CVE-2025-55182](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) [NVD Entry for CVE-2025-55182](https://nvd.nist.gov/vuln/detail/CVE-2025-55182) [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)