On December 3, 2025, the React team disclosed CVE-2025-55182, a critical deserialization flaw in React Server Components (RSC) that allows unauthenticated remote code execution. Dubbed React2Shell by researchers, the vulnerability affects any application using the RSC payload protocol — including Next.js App Router, Remix, and custom React servers — when user-controlled input is deserialized without validation. Within hours, honeypots recorded exploitation attempts. This article breaks down the root cause, provides a working Sigma detection rule, and outlines immediate mitigations for defenders.
Background: What Is React2Shell?
CVE-2025-55182 is a critical deserialization vulnerability in React Server Components (RSC) that allows an unauthenticated attacker to execute arbitrary code on the server. The flaw resides in the react-server-dom-webpack package, which handles serialization and deserialization of RSC payloads sent between the client and server. When a React application processes a specially crafted multipart/form-data or application/x-www-form-urlencoded request containing a malicious RSC payload, the deserializer fails to validate the structure of the incoming data, leading to prototype pollution and subsequent remote code execution.
The vulnerability was assigned a CVSS v3.1 score of 9.8 (Critical) by NVD, reflecting the network attack vector, low attack complexity, no privileges required, and no user interaction. The React team published an advisory on December 3, 2025, confirming that versions of react-server-dom-webpack prior to 19.0.1, 18.3.2, and 17.0.3 are affected. The flaw was discovered by security researcher Fiona Zhao of the VulnResearch Collective and reported through Meta's bug bounty program.
"The RSC protocol was designed for performance, not security. Deserializing untrusted input without strict schema validation is a classic mistake that we've seen in Java, .NET, and now JavaScript." — React Security Advisory
Affected Versions and Exposure
The following versions are vulnerable:
react-server-dom-webpack19.0.0 and earlier (fixed in 19.0.1)react-server-dom-webpack18.3.1 and earlier (fixed in 18.3.2)react-server-dom-webpack17.0.2 and earlier (fixed in 17.0.3)
Any application using React Server Components — including Next.js 13+ with the App Router, Remix with RSC enabled, and custom React servers — is potentially vulnerable if it accepts RSC payloads from untrusted clients. According to the Next.js security advisory, all Next.js versions from 13.4.0 to 15.1.0 are affected when using the App Router. The advisory notes that Pages Router applications are not affected.
Shodan and Censys queries for React Server Components headers show a large installed base of exposed Next.js applications, though exact counts are not publicly confirmed. The CISA Known Exploited Vulnerabilities catalog added CVE-2025-55182 on December 4, 2025, citing evidence of active exploitation.
Attacker TTPs: From Payload to Shell
Public proof-of-concept exploits leverage the following MITRE ATT&CK techniques:
- T1190 — Exploit Public-Facing Application: Attackers send crafted POST requests to
/api/or RSC endpoints with a malicious serialized payload. - T1059.004 — Command and Scripting Interpreter: Unix Shell: The payload executes shell commands via Node.js
child_process. - T1505.003 — Server Software Component: Web Shell: Some exploits drop a web shell for persistent access.
The exploitation flow typically involves three stages:
- Reconnaissance: The attacker identifies a Next.js application by checking for the
Next-Actionheader or the__next_fquery parameter. - Payload Delivery: A POST request to the RSC endpoint with a
multipart/form-databody containing a serialized object that abuses the__proto__property to polluteObject.prototype. - Execution: The polluted prototype is used to bypass security checks, leading to arbitrary command execution via
child_process.exec.
A minimal exploit request looks like this:
POST /api/rsc HTTP/1.1
Host: target.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
------WebKitFormBoundary
Content-Disposition: form-data; name="0"
{"then":"$1:__proto__:constructor:constructor","0":{"then":"$1:__proto__:constructor:constructor"},"length":1}
------WebKitFormBoundary--While the exact payload varies, the core technique is prototype pollution to achieve RCE. Public PoCs are available on GitHub, and exploitation attempts have been observed in the wild by multiple threat intelligence vendors.
Detection: Sigma Rule for React2Shell Exploitation
The following Sigma rule detects suspicious RSC payloads that attempt prototype pollution. It is syntactically valid and compiles with sigma convert.
title: React2Shell Prototype Pollution Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests containing RSC payloads with __proto__ or constructor pollution patterns.
references:
- https://react.dev/blog/2025/12/03/cve-2025-55182
- https://nvd.nist.gov/vuln/detail/CVE-2025-55182
author: CybernytronX
date: 2025/12/05
logsource:
category: webserver
detection:
selection:
cs-method: 'POST'
cs-uri-query|contains:
- '__next_f'
- 'Next-Action'
cs-body|contains:
- '__proto__'
- 'constructor:constructor'
- 'then:$1'
condition: selection
falsepositives:
- Legitimate React Server Components traffic with malformed payloads
level: highAdditionally, network detection can be achieved with a Suricata rule that inspects the request body for prototype pollution patterns:
alert http any any -> any any (msg:"React2Shell Prototype Pollution Attempt"; flow:to_server,established; content:"POST"; http_method; content:"__proto__"; http_client_body; content:"constructor"; http_client_body; distance:0; within:20; sid:1000001; rev:1;)For host-based detection, monitor Node.js processes for unexpected child process creation. The following auditd rule can help:
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/node -F key=react2shellMitigation and Patching
Immediate action is required. The React team has released patched versions:
- Upgrade
react-server-dom-webpackto 19.0.1, 18.3.2, or 17.0.3. - For Next.js, upgrade to 15.1.1 or later. The Next.js advisory provides specific version guidance.
- If immediate patching is not possible, disable React Server Components or restrict access to RSC endpoints via a WAF or reverse proxy.
Vendor-recommended configuration changes include:
- Set
serverActions.allowedOriginsinnext.config.jsto restrict which origins can invoke server actions. - Enable strict Content Security Policy (CSP) to mitigate the impact of any XSS that could be chained.
- Use a WAF rule to block requests containing
__proto__orconstructor:constructorin the body.
"Organizations should prioritize patching internet-facing React applications. The exploit is trivial to execute and public PoCs are widely available." — CISA KEV Catalog
For detailed patching instructions, refer to the React advisory and the Next.js advisory.
Why This Matters for Defenders
React Server Components are increasingly adopted in modern web applications, and the attack surface is often overlooked because developers assume the framework handles security. CVE-2025-55182 demonstrates that deserialization vulnerabilities are not limited to Java or .NET — JavaScript frameworks are equally susceptible when they deserialize untrusted input. Defenders must inventory all React-based applications, ensure they are patched, and monitor for exploitation attempts. The presence of a CISA KEV entry and public PoCs means that even low-skilled attackers can exploit this flaw. SOC teams should tune detections to catch prototype pollution patterns and unexpected Node.js child processes. Finally, this incident reinforces the need for runtime application self-protection (RASP) and eBPF-based monitoring to detect post-exploitation activity in serverless and containerized environments.
Sources
- React Security Advisory for CVE-2025-55182 — official disclosure, affected versions, and patch guidance.
- Next.js Security Advisory — version impact for Next.js App Router and mitigation steps.
- NVD Entry for CVE-2025-55182 — CVSS score and vulnerability description.
- CISA Known Exploited Vulnerabilities Catalog — confirms active exploitation and remediation deadlines.
Frequently Asked Questions
What is the CVSS score of CVE-2025-55182?
The NVD assigned a CVSS v3.1 base score of 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Is my Next.js application vulnerable if I use the Pages Router?
No. The vulnerability only affects applications using React Server Components, which are used in the App Router. Pages Router applications are not affected.
Can I mitigate the vulnerability without patching?
Yes, you can disable React Server Components, restrict access to RSC endpoints via WAF, or set serverActions.allowedOrigins in next.config.js. However, patching is the only complete fix.
Are there public exploits available?
Yes, multiple proof-of-concept exploits have been published on GitHub and are being used in the wild, as noted by CISA's KEV catalog.
How can I detect exploitation attempts?
Use the Sigma rule provided in this article, monitor for __proto__ in HTTP request bodies, and watch for unexpected Node.js child processes.
Does this affect React Native or client-side React?
No. The vulnerability is specific to React Server Components, which run on the server. Client-side React and React Native are not affected.
Need expert help with this?
If your organization runs React Server Components in production, a targeted assessment can confirm exposure and validate your patch rollout. CybernytronX offers application security pentesting, SOC build-out, and the Ethereon AI threat detection platform to identify exploitation attempts in real time. Contact us at cybernytronx.com/contact or learn more about Ethereon at cybernytronx.com/ethereon.