React Server Components and Next.js ("React2Shell"): one request runs code on the server
Identifiers: CVE-2025-55182 · GHSA-fv66-9v8q-g76r · GHSA-9qr9-h5gf-34mp · CVSS 3.1 10.0 (scored by Meta)
What it is
A crafted request to any React Server Components endpoint can run code on the server without logging in, even when the app defines no server functions. It hits Next.js App Router apps and other frameworks built on react-server-dom-*. It was mass-exploited within days of its disclosure in December 2025, including by ransomware groups, and many apps built since still pin an old version.
On CISA's Known Exploited Vulnerabilities list since December 5, 2025.
Who is affected
Versions inside these ranges are affected. The fixed versions are the ones to move to.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| npm | next | >= 14.3.0-canary.77, < 15.0.5 >= 15.1.0-canary.0, < 15.1.9 >= 15.2.0-canary.0, < 15.2.6 >= 15.3.0-canary.0, < 15.3.6 >= 15.4.0-canary.0, < 15.4.8 >= 15.5.0-canary.0, < 15.5.7 >= 16.0.0-canary.0, < 16.0.7 | 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 |
| npm | react-server-dom-webpack | = 19.0.0 >= 19.1.0, < 19.1.2 = 19.2.0 | 19.0.1, 19.1.2, 19.2.1 |
| npm | react-server-dom-turbopack | = 19.0.0 >= 19.1.0, < 19.1.2 = 19.2.0 | 19.0.1, 19.1.2, 19.2.1 |
| npm | react-server-dom-parcel | = 19.0.0 >= 19.1.0, < 19.1.2 = 19.2.0 | 19.0.1, 19.1.2, 19.2.1 |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up next, react-server-dom-webpack, react-server-dom-turbopack, … in your lockfile and compare the version with the ranges above.
How to fix it
Upgrade next to the patched release of your line (15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, or better the newest patch, which also fixes later denial-of-service bugs); 14.3 canaries have no patch, so go back to 14.x stable. Upgrade react-server-dom-webpack, -turbopack or -parcel to 19.0.1, 19.1.2 or 19.2.1 or later if you use them directly. If you ran an affected version on the internet, look for signs of compromise.
Sources
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
- https://github.com/advisories/GHSA-fv66-9v8q-g76r
- https://github.com/advisories/GHSA-9qr9-h5gf-34mp
- https://nvd.nist.gov/vuln/detail/CVE-2025-55182
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.