Critical · exploited · React, Next.js
React2Shell: remote code execution in React Server Components
CVE-2025-55182 lets an unauthenticated attacker send a crafted HTTP request that React decodes into code execution on the server. It affects apps that support React Server Components, including Next.js, even if they define no server function endpoints.
Why it matters to you
Next.js apps on the App Router run React Server Components, so many are in scope, along with React Router, Waku and Redwood SDK setups that use them. Apps with no server, or no framework or bundler that supports React Server Components, aren’t affected.
Check it yourself
- 01Check your lock file for
react-server-dom-webpack,react-server-dom-parcelandreact-server-dom-turbopack. Versions 19.0, 19.1.0, 19.1.1 and 19.2.0 are affected. - 02Check your framework: Next.js, React Router (unstable RSC APIs), Waku,
@vitejs/plugin-rscand Redwood SDK are listed as affected. - 03If your app has no server and nothing in your stack supports React Server Components, it isn’t affected.
Fix it
- 01Upgrade to a fixed React release: 19.0.1, 19.1.2 or 19.2.1.
- 02Upgrade Next.js to the fixed release for your line, for example 14.2.35 for 14.x, 15.5.10 for 15.5.x or 16.0.11 for 16.0.x. Check the Next.js advisory for the exact version before pinning.
- 03Don’t rely on a hosting provider’s temporary mitigation. The React team says to update immediately.
- 04Rebuild, redeploy, and review logs for unusual requests to server function endpoints.
How PatchRig helps
PatchRig identifies which apps and packages are in scope, upgrades React and the framework on a staging copy, redeploys and confirms the fixed versions.