React2Shell: A critical React flaw allowing unauthenticated RCE. Impacts include Next.js, React Router, and apps using Server Components.

CVE-2025-55182: Frequently Asked Questions About React2Shell: React Server Components Remote Code Execution Vulnerability

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

This unauthenticated remote code execution flaw in React has been exploited in the wild and multiple exploit scripts have been made public. Immediate patching is required.

Unauthenticated remote code execution flaw in React can be exploited even if apps do not implement React Server Function endpoints. Apply patches immediately.

The remote host is affected by a remote code execution vulnerability:

  - A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0,     19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and     react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function     endpoints.(CVE-2025-55182)

React Server Components react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0, 19.1.0, 19.1.1, and 19.2.0 are vulnerable to an Unauthenticated Remote Code Execution. An attacker can exploit a flaw in how React decodes payloads sent to React Server Function endpoints through specially crafted requests.

The Next.js Framework on the remote host is affected by a remote code execution vulnerability:

  - A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0,     19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and     react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function     endpoints.(CVE-2025-55182)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple Node.js React Server Components packages are affected by an unauthenticated remote code execution vulnerability. The following Node.js packages and versions are affected:

  - react-server-dom-webpack 19.0, 19.1.0, 19.1.1, 19.2.0
  - react-server-dom-parcel 19.0, 19.1.0, 19.1.1, 19.2.0
  - react-server-dom-turbopack 19.0, 19.1.0, 19.1.1, 19.2.0

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
277585	React Server Components 19.0 / 19.1.0 / 19.1.1 / 19.2.0 Remote Code Execution (React2Shell)	Nessus	CGI abuses	critical
115069	React Server Components 19.0 / 19.1.0 / 19.1.1 / 19.2.0 Remote Code Execution (React2Shell)	Web App Scanning	Component Vulnerability	critical
277108	Next.js Framework React Server Components Remote Code Execution (CVE-2025-55182)	Nessus	Misc.	critical
277105	Node.js React Server Components Unauthenticated Remote Code Execution (CVE-2025-55182)	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-55182

critical

Tenable Plugins

critical

critical

critical

critical