React2Shell
The CVSS 10.0 That Broke the Web 💥

On December 3, 2025, Meta and Vercel coordinated the disclosure of what would become one of the most critical vulnerabilities in modern web development history. CVE-2025-55182 — dubbed "React2Shell" by the security community (echoing the infamous Log4Shell) — is an unauthenticated remote code execution (RCE) vulnerability in React Server Components. 💥

Why This Is a Big Deal 🚨

React isn't just popular — it's everywhere. Used by companies like Facebook, Netflix, Airbnb, Uber, Instagram, and millions of other applications, React powers a massive portion of the modern web. When a critical vulnerability hits React, the blast radius is enormous.

But this isn't just any React vulnerability. This specifically affects React Server Components (RSC) — a relatively new architecture pattern that's been aggressively promoted as the future of React development, especially in Next.js 13+ with the App Router.

The Researcher: Lachlan Davidson

The vulnerability was discovered and responsibly disclosed by security researcher Lachlan Davidson on November 29, 2025. He reported it through Meta's Bug Bounty program, giving the React and Next.js teams time to develop patches before public disclosure.

Davidson later created react2shell.com to document the vulnerability and released proof-of-concept exploits after giving the community time to patch.

To understand the vulnerability, you first need to understand React Server Components (RSC). Don't worry — I'll make this beginner-friendly! 🤓

🤔 Traditional React: Everything in the Browser

Traditionally, React runs entirely in the user's browser:

Problems with this approach:

• Large JavaScript bundles slow down initial page load
• Browser must fetch data from APIs (extra network requests)
• Database queries and sensitive operations require API endpoints
• Poor SEO (search engines see empty HTML until JS runs)

🚀 React Server Components: Split the Work

RSC introduced in React 18 (2022) and heavily promoted in React 19 (2024) allows components to run on the server:

Benefits of RSC

• ⚡ Faster page loads — Less JavaScript shipped to browser
• 🔐 Better security — Database queries stay on server
• 📈 Better SEO — Server sends rendered HTML
• 💰 Lower costs — Less client-side processing

The Catch: Complexity

RSC introduces significant complexity:

• Components must declare if they're "server" or "client"
• Server components can't use React hooks like useState
• Data must be serialized to travel from server to client
• Developers must think about where code runs

This last point — serialization — is where the vulnerability lives. 🎯

Here's where it gets technical (but stay with me!). RSC needs a way to send component data from server to client. React's team invented a custom protocol called "Flight". 🛫

Why Not Just Use JSON? 🤔

Great question! JSON has limitations:

• ❌ Can't represent JavaScript functions
• ❌ Can't represent React component references
• ❌ Can't represent Promises or streaming data
• ❌ Verbose for large component trees

React needed something more powerful. So they created Flight — a custom binary serialization format. 📦

How Flight Works

Flight Data Example

Here's what Flight data actually looks like (simplified):

// This is NOT JSON - it's a custom format
M1:{"id":"UserProfile","chunks":[],"name":""}
S2:"react.suspense"
J3:{"username":"alice","followers":1337}
M4:{"id":"./components/Avatar.js","chunks":["client42"],"name":"Avatar"}

// Each line represents a "chunk" of data
// M = Module reference, S = String, J = JSON-like data

The Two Directions

Flight works in two directions:

Server Actions: The Attack Vector

Server Actions are React functions that run on the server, callable from the client:

// app/actions.js
'use server'  // This marks it as a Server Action

export async function createPost(formData) {
  const title = formData.get('title');
  const content = formData.get('content');
  
  // Save to database
  await db.insert({ title, content });
}

When the client calls this, it sends a Flight-encoded payload to the server. The server deserializes that payload to figure out which function to call and with what arguments.

That deserialization is where the bug lives. 🐛

Now for the technical heart of this: what exactly went wrong? 🔍

The Core Issue: Unsafe Deserialization

The vulnerability is classified as CWE-502: Deserialization of Untrusted Data. This is a classic class of vulnerabilities that has plagued software for decades (Java, PHP, Python — all have had major deserialization bugs).

What React Did Wrong

React's Flight deserialization code made several critical mistakes:

The Attack Mechanism

Here's the simplified attack flow:

The Technical Details (For Advanced Readers)

React's Flight deserialization uses a concept called "Chunks" — references to pieces of data. During normal operation, React resolves these as JavaScript Promises.

The vulnerability allowed attackers to craft a fake Chunk object and submit it. Because React didn't validate property ownership (no hasOwnProperty checks), it would access attacker-controlled properties and treat them as legitimate.

// Vulnerable deserialization logic (conceptual)
function processChunk(chunk) {
  // ❌ No validation that chunk is legitimate!
  const moduleId = chunk.moduleId;  // Attacker-controlled!
  const exportName = chunk.exportName;  // Attacker-controlled!
  
  // ❌ Dynamically resolve module based on attacker data
  const module = require(moduleId);  // 💥 RCE!
  const func = module[exportName];  // 💥 Can call ANY function
  
  return func(...chunk.args);  // With ANY arguments!
}

// Patched version with validation
function processChunk(chunk) {
  // ✅ Verify structure
  if (!isValidChunk(chunk)) {
    throw new Error('Invalid chunk');
  }
  
  // ✅ Verify property ownership
  if (!chunk.hasOwnProperty('moduleId')) {
    throw new Error('Invalid module reference');
  }
  
  // ✅ Whitelist allowed modules
  if (!ALLOWED_MODULES.includes(chunk.moduleId)) {
    throw new Error('Module not allowed');
  }
  
  // Now safe to proceed...
}

Let's walk through a practical exploitation scenario. This helps understand why this vulnerability is so dangerous. 🎯

Prerequisites for Exploitation

An application is vulnerable if:

• ✅ Uses React 19.x with Server Components
• ✅ Uses Next.js 15.x or 16.x with App Router
• ✅ Has Server Actions enabled (default in Next.js App Router)
• ❌ Even if you don't explicitly use Server Functions, you're still vulnerable if RSC is supported!

Attack Scenario: Compromising a Next.js App

Proof of Concept Exploits

Multiple working PoC exploits became public within 48 hours of disclosure:

Security researchers confirmed near-100% exploit reliability against default configurations. This means it "just works" — no special conditions, no lucky timing, no complex setup. 😱

Real-World Exploitation

Within hours of public disclosure, threat intelligence teams detected active exploitation:

• AWS Threat Intelligence: Observed China state-nexus groups (Earth Lamia, Jackpot Panda) exploiting within hours
• Wiz Research: Confirmed actual victims compromised starting December 5, 6:00 AM UTC
• Datadog: Detected weaponized payloads in the wild
• GreyNoise: Massive scanning activity detected globally

Let's walk through the complete timeline of this vulnerability. 📅

Let's quantify just how widespread this vulnerability is. The numbers are staggering. 📊

By the Numbers

Affected Frameworks & Packages

Major Companies Potentially Affected

While we don't have confirmed lists, companies using Next.js 13+ or React 19 with RSC include:

• 🏠 Airbnb — Uses React/Next.js extensively
• 🎬 Netflix — React-based UI
• 📺 Hulu — Streaming platform
• 🚗 Uber — Web applications
• 📱 Instagram (Meta) — React's creator
• 💼 Countless SaaS companies, startups, and enterprise applications

Downstream Effects

Beyond direct exploitation, this vulnerability caused:

• 🚨 Emergency patching efforts across thousands of organizations
• 🔥 Infrastructure disruptions (Cloudflare outage while deploying mitigations)
• 💰 Security spending on scanners, incident response, forensics
• 😰 Developer stress and emergency on-call rotations
• 📉 Trust erosion in the React ecosystem
• 🤔 Architectural questioning of RSC design decisions

If you're running React or Next.js, here's what you need to do. Right now. ⚡

🔍 Am I Vulnerable?

Check your dependencies:

# For npm users
npm list react react-server-dom-webpack next

# For yarn users
yarn why react
yarn why next

# For pnpm users
pnpm list react next

You're vulnerable if you have:

• ✅ React 19.0.0, 19.1.0, 19.1.1, or 19.2.0 AND
• ✅ Any react-server-dom-* package from those versions OR
• ✅ Next.js 15.x or 16.x with App Router

✅ Immediate Remediation

Step 1: Update Dependencies

# For React packages
npm update react@19.0.1 react-dom@19.0.1
# or
npm update react@19.1.2 react-dom@19.1.2
# or
npm update react@19.2.1 react-dom@19.2.1

# For Next.js
npm update next@latest

# Then verify
npm audit

Step 2: Deploy Immediately

• This is a break-glass emergency — deploy outside normal release windows
• Test in staging but don't wait long
• Every hour of delay = more risk

🛡️ Temporary Mitigations (If You Can't Patch Immediately)

If you absolutely cannot patch right away:

🕵️ Detection: Have I Been Compromised?

If you were running vulnerable versions, check for indicators of compromise (IOCs):

# Look for suspicious POST requests to Server Action endpoints
grep -i "POST.*RSC" /var/log/nginx/access.log

# Look for unusual process spawning
grep -i "child_process\|exec\|spawn" /var/log/your-app.log

# Check for cryptocurrency miner processes
ps aux | grep -i "xmrig\|miner\|cryptonight"

# Check for unauthorized network connections
netstat -tunapl | grep ESTABLISHED

IOCs published by security researchers:

• Datadog: IOC Repository
• Suspicious IPs: Check threat intelligence feeds for known attacker IPs
• File modifications: Look for new or modified files you didn't create

📋 Incident Response Checklist

If you find evidence of compromise:

1. Isolate affected systems — disconnect from network if possible
2. Preserve evidence — take memory dumps, save logs
3. Rotate all secrets — database credentials, API keys, environment variables
4. Audit for backdoors — check crontabs, SSH keys, startup scripts
5. Engage incident response team (internal or external)
6. Notify affected parties — customers, partners, regulators (as required)
7. Document everything — timeline, actions taken, lessons learned

React2Shell isn't just a bug — it's a wake-up call about the direction of modern web development. Let's talk about what this really means. 🤔

The Architectural Question

React Server Components represent a fundamental shift in how we think about web applications. But with that shift comes massive complexity:

• Custom serialization formats (Flight) instead of battle-tested standards (JSON, GraphQL)
• Code that runs in multiple contexts (client vs server)
• Tight coupling between framework code and application code
• New attack surfaces that didn't exist before

Lesson 1: Deserialization Is Always Dangerous

Unsafe deserialization has been a known vulnerability class for decades:

• Java: Countless deserialization RCEs
• PHP: unserialize() vulnerabilities
• Python: pickle module warnings
• Ruby: YAML deserialization issues

The security community has been shouting about this for years. Yet here we are, reinventing the same vulnerability in JavaScript. 😔

Lesson 2: Simplicity Is Underrated

The React team could have used JSON for data transfer. Yes, it has limitations. But those limitations are also safety features. You can't execute code from JSON. You can't reference arbitrary modules. The constraints protect you.

Flight's "power" — its ability to serialize more complex structures — is exactly what made this vulnerability possible.

Lesson 3: Framework Magic Has Costs

Modern frameworks hide complexity from developers. That's good for productivity, but dangerous for security:

Lesson 4: Supply Chain Risk Is Real

Many teams affected by React2Shell didn't consciously choose to use React Server Components. They:

• Upgraded Next.js and got RSC by default
• Used a template that included RSC
• Inherited it through a dependency
• Didn't realize their build tool was bundling vulnerable packages

You can't secure what you don't know you have. This is why:

• 📋 Maintain a Software Bill of Materials (SBOM)
• 🔍 Regularly scan dependencies for vulnerabilities
• 📚 Understand your dependency tree
• ⚙️ Review what "magic" features your framework enables

Lesson 5: Disclosure Timing Is Hard

This was a coordinated disclosure done right:

• ✅ Researcher gave Meta time to develop patches
• ✅ Meta coordinated with cloud providers to prepare mitigations
• ✅ Patches were available at disclosure
• ✅ Responsible disclosure period was short (4 days) given severity

Yet attackers still weaponized it within hours. There's no perfect answer. Disclose too early, attackers exploit before patches exist. Disclose too late, someone else finds it and sells it.

Lesson 6: The Modern Web Is Fragile

React powers so much of the web that one vulnerability threatened millions of applications simultaneously. This concentration of risk is unprecedented:

• One framework dominates (React)
• One architectural pattern pushed hard (RSC)
• One vulnerability affects everything

Monocultures are dangerous in agriculture. They're also dangerous in software. 🌾

Let's wrap up with practical advice you can apply today. 💪

Resources for Further Learning

• 📚 React Security Advisory: Official React Blog
• 🔍 react2shell.com: Researcher's Technical Site
• 📖 OWASP: Learn about deserialization vulnerabilities
• 🛡️ CWE-502: Deserialization of Untrusted Data
• 📊 Wiz Blog: Detailed technical analysis

React2Shell (CVE-2025-55182) is a critical vulnerability that achieved the maximum CVSS score of 10.0. It's a textbook example of unsafe deserialization — a vulnerability class we've known about for decades, now appearing in one of the world's most popular frontend frameworks. 💥

The speed of weaponization was breathtaking: from disclosure to nation-state exploitation in less than 24 hours. From first public PoC to mass exploitation in 48 hours. This is the modern threat landscape. There's no grace period anymore.

But beyond the immediate security crisis, React2Shell raises deeper questions about the direction of web development:

• Are we adding complexity faster than we can secure it?
• Do custom protocols and "powerful" abstractions create more problems than they solve?
• Is the concentration of the web ecosystem on a few frameworks creating systemic risk?

I don't have easy answers to these questions. What I do know is that security cannot be an afterthought. When we design new architectural patterns, new protocols, new "magic" features — security must be part of the design process from day one, not something bolted on later. 🔒

For developers using React and Next.js: patch immediately if you haven't already. For the broader community: let's take this as a learning opportunity. Study the vulnerability. Understand the attack surface. Question complexity. Favor simplicity. Build defensively.

The web keeps evolving. New frameworks, new patterns, new abstractions will keep coming. Let's make sure we're learning from vulnerabilities like React2Shell so we don't repeat the same mistakes with new technology. 🔥

Stay secure, keep learning, and remember: complexity is not your friend. 😉

🔴 Official Advisories

• React Team – Critical Security Vulnerability in React Server Components
  react.dev/blog/2025/12/03
• Vercel – Summary of CVE-2025-55182
  vercel.com/changelog/cve-2025-55182
• Lachlan Davidson – react2shell.com (Official PoC Site)
  react2shell.com

🔬 Security Research

• Wiz Security – Critical RCE Vulnerabilities Discovered in React & Next.js
  wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182
• AWS Security – China-nexus groups rapidly exploit React2Shell
  aws.amazon.com/blogs/security
• Datadog Security Labs – Technical Analysis & IOCs
  securitylabs.datadoghq.com
• Tenable – React2Shell FAQ
  tenable.com/blog/react2shell

📰 Coverage

• SecurityWeek – React2Shell In-the-Wild Exploitation Expected
• Infosecurity Magazine – Maximum-Severity React2Shell Vulnerability
• Snyk Security Advisory – Critical RCE in RSC
• Multiple security firms and threat intelligence providers

🔗 Related Reading

• Cloudflare Dec 5 Outage – How React2Shell mitigations caused a major outage
  Read our deep dive
• CWE-502 – Deserialization of Untrusted Data
• Log4Shell – For comparison to another CVSS 10.0 vulnerability

Found this helpful? Share it! 🚀