.svg)
.svg){kind=logo}
.svg)
CVE-2025-55182, also known as React2Shell, is a critical CVSS 10.0 remote code execution (RCE) vulnerability affecting applications that rely on React Server Components (RSC). If your application supports RSC, even indirectly through frameworks like Next.js, you are likely exposed and should patch immediately.
Understanding the Context Behind CVE-2025-55182
On December 3, 2025, the React Team publicly confirmed a severe server-side vulnerability in RSC following a disclosure by security researcher Lachlan Davidson on November 29, 2025. Davidson’s findings prompted the creation of React2Shell.com, highlighting the ease with which attackers can exploit the flaw.
Because RSCs are automatically enabled in many modern React frameworks, organizations may be vulnerable even if they do not explicitly use server functions. This is especially dangerous for companies running default configurations or recently upgraded versions of React.
What Is CVE-2025-55182?
CVE-2025-55182 is a pre-authentication RCE vulnerability that allows attackers to run arbitrary code on a server without logging in. The issue stems from insecure deserialization of untrusted data in Server Function endpoints. By sending specially crafted HTTP requests, an attacker can exploit this weakness to execute code, gain control of the server, and potentially pivot deeper into the environment.
Any framework that bundles the react-server implementation is likely impacted.
Affected Components and Versions
Likely Affected Frameworks
- Next.js (15.x, 16.x)
- React Router with RSC APIs
- Expo
Redwood SDK - Waku
- Vite and Parcel plugins
React was originally designed for client-side execution. Because server-side React is relatively new, many organizations are still unfamiliar with how RSCs behave or even the risks they introduce. As a result, default settings alone may put your applications at risk.
Immediate Remediation Steps for CVE-2025-55182
If your systems are running any of the impacted versions, remediation should begin immediately. BD Emerson’s security engineers are available to help teams validate exposure, implement controls, and apply the necessary patches.
1. Upgrade React and Dependencies
Update to the patched versions as soon as possible:
- React: 19.0.1+, 19.1.2+, or 19.2.1+
- Next.js: 15.0.5+, 15.1.9+, 15.2.6+, 15.3.6+, 15.4.8+, 15.5.7+, or 16.0.7+
React’s official blog provides detailed upgrade instructions for frameworks and toolchains that use RSC, including React Router, Expo, Redwood, Waku, and others.
2. Implement Temporary Controls if Patching Is Delayed
If your team cannot patch immediately, deploy compensating controls to reduce the risk of exploitation:
- Deploy WAF rules to block malicious serialization payloads before they reach your application.
- Tighten network egress controls to prevent reverse shells, reducing an attacker’s ability to establish outbound connections.
- Enable comprehensive logging across all Server Function invocations to detect anomalies early and respond faster.
These controls are not substitutes for patching but can significantly reduce your exposure window.
3. Strengthen Your Long-Term Security Protocols
CVE-2025-55182 is a reminder of the risks introduced by complex serialization and server-side frameworks. Build long-term resilience by:
- Running Node.js processes with minimal privileges to limit escalation pathways.
- Using container isolation with restricted capabilities so attackers cannot break out of the runtime environment.
- Leveraging Runtime Application Self-Protection (RASP) to block suspicious behavior from inside the application.
- Regularly scanning and patching JavaScript dependencies to eliminate known vulnerabilities before attackers exploit them.
The Impact of CVE-2025-55182 So Far
This vulnerability is already being exploited in the wild. Key developments include:
- Amazon Threat Intelligence reported exploitation tied to China state-nexus threat actors within 24 hours of disclosure.
- A public Proof-of-Concept (PoC) was released by Davidson on December 4.
- Earlier exploitation attempts required certain configurations, but new PoCs work against default setups, increasing the likelihood of widespread attacks.
- Companies in financial services, technology, and e-commerce have already observed reconnaissance and attempted exploitation.
Given the critical severity and the speed at which attacker activity is increasing, organizations should treat this as a high-priority incident requiring immediate action.
Protect Your React Applications Today
BD Emerson’s security experts are actively helping organizations assess exposure, patch vulnerable systems, and deploy compensating controls for CVE-2025-55182. If your applications rely on React, Next.js, or any RSC-enabled framework, time is critical.
Contact BD Emerson today for a rapid assessment
