Skip to main content
    Back
    ·1 min read

    React2Shell (CVE-2025-55182): Remote Code Execution in React Server Components

    Advisory summary for CVE-2025-55182, a critical remote code execution vulnerability affecting React Server Components.

    cve
    react
    rce
    advisory

    Summary

    CVE-2025-55182, widely called React2Shell, is a critical remote code execution vulnerability in React Server Components. An unauthenticated attacker could send a crafted request to a vulnerable server and run code on it.

    Who is affected

    Applications that use React Server Components, including frameworks that build on them such as Next.js App Router, when running an affected React version.

    What to do

    1. Check the React and framework versions you run against the official React and framework advisories.
    2. Upgrade to the patched versions named in those advisories.
    3. Review logs for unexpected requests to server function endpoints.
    4. If you cannot patch at once, ask your host or web application firewall provider about interim protections.

    Always confirm affected and fixed versions in the official advisories before acting. Need help? Contact us.

    This article is a short summary kept so the page keeps working while the full text is imported from the Securelyn content repository.

    Back