StackPrism

React2Shell checker: is your app affected by CVE-2025-55182?

React2Shell (CVE-2025-55182) is an unauthenticated remote code execution flaw in React Server Components. You are affected if your app runs React Server Components on a server with react-server-dom-webpack, -parcel or -turbopack 19.0.0, 19.1.0, 19.1.1 or 19.2.0, which includes Next.js 15.x and 16.x apps using the App Router before the patched releases.

Disclosed . This page was last updated .

Add your lockfile: it says which versions were installed.

Checked against OSV.dev, CISA KEV, FIRST EPSS, npm, PyPI, deps.dev, endoflife.date and Docker Hub, live.

What happened

On 3 December 2025 the React team disclosed CVE-2025-55182, a flaw in how React Server Components decode requests to Server Functions. An unauthenticated attacker can run code on the server with one crafted request. It was reported through Meta’s bug bounty on 29 November 2025 and rated CVSS 10.0 (React’s announcement).

The bug is in react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack 19.0.0, 19.1.0, 19.1.1 and 19.2.0, fixed in 19.0.1, 19.1.2 and 19.2.1 (GHSA-fv66-9v8q-g76r). Next.js bundles these packages, so it published its own advisory with patched releases for every 15.x and 16.x line (GHSA-9qr9-h5gf-34mp).

CISA added CVE-2025-55182 to its Known Exploited Vulnerabilities catalog on 5 December 2025, so attackers are using it (CISA KEV). React later shipped follow-up fixes in the same code: CVE-2025-55183, CVE-2025-55184, CVE-2025-67779 and CVE-2026-23864.

Affected versions

  • react-server-dom-webpack

    Affected
    19.0.0, 19.1.0, 19.1.1, 19.2.0
    Fixed or safe
    19.0.1, 19.1.2, 19.2.1

  • react-server-dom-parcel

    Affected
    19.0.0, 19.1.0, 19.1.1, 19.2.0
    Fixed or safe
    19.0.1, 19.1.2, 19.2.1

  • react-server-dom-turbopack

    Affected
    19.0.0, 19.1.0, 19.1.1, 19.2.0
    Fixed or safe
    19.0.1, 19.1.2, 19.2.1

  • next

    Affected
    15.x and 16.x (App Router), and canaries from 14.3.0-canary.77
    Fixed or safe
    15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7

Who is affected

Affected: apps that run React Server Components on a server, through Next.js (App Router), React Router’s RSC mode, Waku, @parcel/rsc, @vitejs/plugin-rsc or rwsdk, with an affected react-server-dom package.

Not affected: React apps without a server (client-side only, static exports), and apps that don’t use a framework, bundler or plugin with React Server Components. The react and react-dom packages themselves don’t carry this flaw.

What to do

  1. Upgrade Next.js to the patched release for your line. React’s post lists newer patches that also carry the follow-up fixes, for example next@15.5.10 for 15.5.x, and next@14.2.35 for 13.3.x to 14.x.
  2. Other React Server Components setups: upgrade react, react-dom and your react-server-dom package to the latest 19.x release, as React’s post shows for each framework.
  3. If an affected version ran in production, treat the server as exposed: CISA reports active exploitation, so review its logs and rotate the secrets it could read.

Sources

Hear about the next one first

Connect GitHub and StackPrism re-checks your repos every day, with an alert when a new critical finding such as a known-exploited advisory turns up. Free to start.

Map my repoDesign a stack