CVE-2025-55182: React Server Components pre-auth remote code execution (React2Shell)

Exploited in the wild Critical 10.0 EPSS 99.7%

React Server Components unsafely deserialize payloads sent in HTTP requests to Server Function endpoints, so an unauthenticated attacker can run code on the server with one crafted request. Apps are exposed even if they define no Server Functions, as long as they support React Server Components; Next.js App Router apps (15.x, 16.x and 14.3 canaries) bundle the vulnerable code. CISA added it to KEV on 5 December 2025 and lists it as used in ransomware campaigns; Next.js advises rotating secrets on apps that were online and unpatched on 4 December 2025.

Also known as “React2Shell”.

CVE-2025-55182CVE identifier
10.0CVSS 3.1 base score (critical)
2025-12-05added to CISA's exploited list (US federal deadline 2025-12-12)
99.7%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
2025-12-03published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run the affected software and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
Rebuild and redeploy the application (restart the Node.js process or container) so the patched packages are loaded.
If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
Because this flaw is being exploited, also check the server for signs of compromise.

Affected and fixed versions

Affected:

react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack 19.0.0, 19.1.0, 19.1.1 and 19.2.0
Next.js 15.x and 16.x using the App Router (before the fixed releases below)
Next.js 14.3.0-canary.77 and later canary releases

Fixed in:

react-server-dom-* 19.0.1
react-server-dom-* 19.1.2
react-server-dom-* 19.2.1
Next.js 15.0.5
Next.js 15.1.9
Next.js 15.2.6
Next.js 15.3.6
Next.js 15.4.8
Next.js 15.5.7
Next.js 16.0.7
Next.js 15.6.0-canary.58
Next.js 16.1.0-canary.12

Am I affected?

npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack next
npx fix-react2shell-next   # Vercel's checker/upgrader for Next.js apps

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Built from source

# Next.js: install the latest patch for your line (React's blog, updated 26 Jan 2026, also covers follow-up CVEs):
npm install next@15.5.10   # 15.5.x; others: 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 16.0.11, 16.1.5
# on 14.3.0-canary.77+ canaries: npm install next@14
# other RSC setups:
npm install react@latest react-dom@latest react-server-dom-webpack@latest
# then rebuild and redeploy the app

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

If you cannot patch yet

There is no workaround; Next.js says upgrading is required. Hosting-provider WAF rules are only a stop-gap.
After patching, rotate all application secrets if the app was online and unpatched as of 4 December 2025, 1:00 PM PT (Next.js advisory).

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ; https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file ; https://nvd.nist.gov/vuln/detail/CVE-2025-55182

Related vulnerabilities

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.