React2Shell (CVE-2025-55182): the React Server Components RCE, and why the December patch is not enough now

What happened

On 29 November 2025, Lachlan Davidson reported a flaw in React Server Components through Meta’s bug bounty. React published fixes and disclosed it on 3 December 2025 (React).

• The bug: React’s server packages unsafely deserialized payloads sent to Server Function endpoints. That gave an unauthenticated attacker remote code execution. It is rated CVSS 10.0 (CVE-2025-55182).
• No opt-in needed: an app “may still be vulnerable” even if it defines no Server Functions, as long as it supports React Server Components (React).
• Next.js: Next.js tracked its downstream impact as CVE-2025-66478 (Next.js). That ID was later rejected as a duplicate of CVE-2025-55182 (CISA KEV).

Attacks started fast. AWS saw China-nexus groups, including Earth Lamia and Jackpot Panda, exploiting it “within hours” of disclosure (AWS). CISA added it to the Known Exploited Vulnerabilities catalog on 5 December 2025, with a 12 December deadline for federal agencies, and marks ransomware use as “Known” (CISA KEV).

The fix kept growing:

• 11 December 2025: researchers studying the patch found two more bugs. CVE-2025-55184 is a denial of service, and CVE-2025-55183 can return the compiled source code of Server Functions. The first DoS fix was incomplete, so a complete one shipped as CVE-2025-67779 (Next.js).
• 26 January 2026: CVE-2026-23864, more DoS cases. React says 19.0.4, 19.1.5 and 19.2.4 fix the December and January bugs. None of these allow code execution (React).
• 14 October 2026: a new unauthenticated RCE in React Server Components (GHSA-xqc2-xf4c-x3h3, CVSS 9.5). React says it hits only “extremely rare cases” where a response carries multiple typed arrays and an attacker-controlled value. It affects every release up to 19.3.0, including all the earlier fixes. Fixed in 19.0.9, 19.1.10, 19.2.9 and 19.3.1 (React GHSA). See our Next.js October 2026 advisory.

Am I affected?

The original bug affected react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack at 19.0.0, 19.1.0, 19.1.1 and 19.2.0. Frameworks built on them were affected too: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk. If your React code never runs on a server, you were not affected (React).

For Next.js, apps using the App Router on 15.x, 16.x or 14.3.0-canary.77 and later canaries were affected. Next.js 13.x, 14.x stable, Pages Router apps and the Edge Runtime were not (Next.js).

# What your lockfile actually resolves
npm ls next react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack
pnpm why next
yarn why next

# The installed Next.js version, from your app directory
node -p "require('next/package.json').version"

# The version inside the image you deployed
docker run --rm --entrypoint node your-image:tag -p "require('next/package.json').version"

What to do now

1. Upgrade to today’s patched versions, not December’s. For the React server packages, use 19.0.9, 19.1.10, 19.2.9 or 19.3.1 or later (React GHSA). For Next.js, use 15.5.28 or 16.4.1 or later (Next.js). Next.js 15.0 to 15.4 got no October release, so move to 15.5.
2. For other frameworks (React Router, Waku, Parcel, Vite RSC, RedwoodSDK), upgrade the framework and confirm which react-server-dom-* version it resolves.
3. Rebuild and redeploy. A bumped package.json does nothing until the running image changes.
4. Do not rely on a WAF. Next.js says there is no workaround and upgrading is required (Next.js). Vercel’s npx fix-react2shell-next tool bumps Next.js versions for you, but check what it picks against the October versions above.
5. Look for compromise. Next.js advises that if your app was online and unpatched as of 4 December 2025 at 1:00 PM PT, you should rotate its secrets, starting with the most critical (Next.js). CISA asks you to check every internet-facing instance for signs of compromise (CISA KEV). Attackers AWS observed ran whoami and id, wrote /tmp/pwned.txt and read /etc/passwd (AWS). Look for similar process activity from your Node.js server.
6. Move secrets out of Server Function code. CVE-2025-55183 can expose secrets written directly into Server Function source. Values read from process.env at runtime are not exposed (React).

Why this is part of the Vulnpocalypse

React2Shell was a maximum-severity bug that needed no opt-in: a default Next.js App Router app was exposed. Attackers had it within hours. Then the patch itself became a research target: the December follow-ups were found by people examining the React2Shell fix (Next.js). One disclosure turned into five CVEs and, ten months later, a second RCE in the same protocol.

The lesson for developers is upgrade speed. A team that can ship a framework patch release in an hour handles a series like this as routine. A team that pins and forgets ends up on a version that was “fixed” in December and is vulnerable again in October.

Sources

• React: Critical Security Vulnerability in React Server Components (3 Dec 2025)
• React: Denial of Service and Source Code Exposure in React Server Components
• Next.js: Security Advisory CVE-2025-66478
• Next.js: Security Update, 11 December 2025
• Next.js: Security Update, 14 October 2026
• React GHSA-xqc2-xf4c-x3h3: RCE in React Server Components (Oct 2026)
• CISA Known Exploited Vulnerabilities: CVE-2025-55182
• AWS Security Blog: China-nexus groups rapidly exploit React2Shell
• CVE-2025-55182 on cve.org