Article
React2Shell — The Day 5 Reality Check
React2Shell (CVE-2025-55182) is a critical React Server Components flaw. See how exploitation grew in the five days after disclosure and what to do.
Read more
Exploited vulnerability
React2Shell (CVE-2025-55182) in React Server Components
CVE-2025-55182
CVE-2025-55182 is a flaw in React Server Components.
- On CISA KEV
- CVE ID
- CVE-2025-55182
- CISA KEV
- Listed
- Affected product
- React Server Components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack)
- Exploited
- Yes
- Published
- December 2025
In short
CVE-2025-55182 is a flaw in React Server Components. React turns web requests into server function calls, and a crafted request can make the server run attacker code without any login. It is widely called React2Shell. CISA lists it as exploited and flags known ransomware campaign use.
- CVECVE-2025-55182
- ProductMeta (React) React Server Components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedUpgrade React packages · If you cannot patch yet
What it allows
An outsider with no account can send one crafted HTTP request to a server function endpoint and run code on the server. The React team rates it CVSS 10.0, and NVD lists 10.0 on CVSS v3.1 (score supplied by Meta). The React team also warns that an app may be vulnerable even if it defines no server function endpoints, as long as it supports React Server Components.
Who is affected
Per the React team, versions 19.0, 19.1.0, 19.1.1 and 19.2.0 of react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack. Frameworks and bundlers that include these packages are affected: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk. The Canadian Centre for Cyber Security adds that Next.js 15.x and 16.x are affected. An app whose React code does not use a server, or whose tooling has no Server Components support, is not affected.
A researcher reported the flaw to the React team on 29 November 2025. The team published its advisory on 3 December 2025, the same day NVD published the record. CISA added CVE-2025-55182 to its Known Exploited Vulnerabilities (KEV) catalog on 5 December 2025. The KEV entry flags known use in ransomware campaigns.
The KEV entry notes that CVE-2025-66478 was rejected but is tied to this flaw, so scanners may show either id. The Canadian Centre for Cyber Security said it saw open-source reporting that several working exploit examples exist and that the flaw is easy to exploit in the wild. The sources opened here give no first-exploitation date and do not name which actors used the flaw, so no actor is attributed on this page.
CISA asks owners to check for signs of compromise on all internet-facing React instances after applying mitigations.
What to do
-
Upgrade React packages
Move react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack to 19.0.1, 19.1.2 or 19.2.1, the fixed versions named by the React team. Then update the framework you use (for example Next.js) as its own maintainers instruct.
-
Do not rely on hosting-provider filters
The React team says temporary mitigations applied by hosting providers should not be trusted as a fix. Update anyway.
-
If you cannot patch yet
The Canadian Centre for Cyber Security suggests a web application firewall rule for malformed requests to server function endpoints, limiting access to trusted networks, or temporarily removing Server Components and Server Functions.
-
Detect and hunt
CISA says to check all internet-facing React instances for signs of compromise after mitigation. Look at web server logs for odd POST requests to server function endpoints before the patch date, and at the app host for new processes, files or outbound connections.
Questions
What is React2Shell?
React2Shell is the common name for CVE-2025-55182, a flaw in React Server Components. One crafted HTTP request to a server function endpoint can run code on the server with no login. The React team rates it CVSS 10.0.
Which versions are affected by CVE-2025-55182?
Versions 19.0, 19.1.0, 19.1.1 and 19.2.0 of react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack are affected. Frameworks that include them, such as Next.js, react-router and waku, are affected too.
Is React2Shell being exploited?
Yes. CISA added CVE-2025-55182 to its Known Exploited Vulnerabilities catalog on 5 December 2025 and flags known ransomware campaign use. The Canadian Centre for Cyber Security said working exploit examples exist and the flaw is easy to exploit.
How do I fix React2Shell?
Update the react-server-dom packages to 19.0.1, 19.1.2 or 19.2.1, then update your framework, for example Next.js, as its maintainers instruct. The React team says not to rely on hosting-provider filters as a fix.
In our research
- React2Shell — The Day 5 Reality Check December 2025
- Exploited vulnerabilities in 2025: what ENISA reports October 2026
- TeamPCP Threat group
Sources
- Critical Security Vulnerability in React Server Components React team (Meta)
- CVE-2025-55182 record NIST NVD
- Known Exploited Vulnerabilities catalog CISA
- AL25-018 Vulnerability affecting React Server Components Canadian Centre for Cyber Security
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.