URGENT: Critical React2Shell Vulnerability (CVE-2025-55182) – Update React 19 and Next.js Now

🚨 CRITICAL SECURITY ALERT: React2Shell Vulnerability

A maximum-severity vulnerability (CVE-2025-55182) has been discovered in React Server Components, affecting React 19 and Next.js 15/16. Immediate action is required.

What is React2Shell?

React2Shell is a critical remote code execution (RCE) vulnerability that allows attackers to execute arbitrary code on servers running affected versions of React and Next.js. This pre-authentication flaw was responsibly reported by security researcher Lachlan Davidson.

Affected Versions

  • React: All 19.x versions (before 19.1.0)
  • Next.js: 15.x and 16.x using App Router
  • Payload CMS: Applications built on affected Next.js versions

Immediate Action Required

If you’re running any of the affected versions, upgrade immediately:

React 19 Upgrade:

npm install react@19.1.0 react-dom@19.1.0
# or
yarn add react@19.1.0 react-dom@19.1.0

Next.js 15 Upgrade:

# For Next.js 15.x
npm install next@15.5.7
# or specific patch versions:
# 15.4.8, 15.3.6, 15.2.6, 15.1.9

Next.js 16 Upgrade:

npm install next@latest

Why This Matters

This vulnerability affects millions of web applications using React Server Components. Default configurations are vulnerable, meaning many applications are at risk without any special setup required by attackers.

Detection and Mitigation

  1. Audit your dependencies: Check package.json for React 19.x or Next.js 15.x/16.x
  2. Review deployment logs: Look for suspicious activity
  3. Apply patches immediately: Don’t wait for maintenance windows
  4. Monitor security advisories: Stay updated on additional patches

Additional Resources

⚠️ This is not a drill. The vulnerability is actively being exploited. Update your applications now.

Hashtags: #ReactSecurity #NextJS #WebSecurity #CVE202555182 #React2Shell #CriticalVulnerability #WebDevelopment

Search

Categories

Archives