React2Shell: A critical React flaw allowing unauthenticated RCE. Impacts include Next.js, React Router, and apps using Server Components.

CVE-2025-55182: Frequently Asked Questions About React2Shell: React Server Components Remote Code Execution Vulnerability

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

This unauthenticated remote code execution flaw in React has been exploited in the wild and multiple exploit scripts have been made public. Immediate patching is required.

Unauthenticated remote code execution flaw in React can be exploited even if apps do not implement React Server Function endpoints. Apply patches immediately.

Detections

Analytics

CVE-2025-55182

critical

Vulnerable Software