React2Shell: When 'Experimental' Became 'Exploitable' in Production
Jan 3, 2026·5 min read·31 visits
Executive Summary (TL;DR)
React Server Components (RSC) inadvertently allowed unauthenticated attackers to access the Javascript 'constructor' via the Flight protocol. Combined with a build error that pushed unsafe experimental code to stable releases, this creates a trivial RCE vector (CVSS 10.0). Affects Next.js 14/15 and other RSC frameworks. Patch immediately.
A critical RCE in React Server Components (RSC) caused by unsafe deserialization in the Flight protocol, exacerbated by a build pipeline failure that shipped experimental code to production. Attackers can execute arbitrary code by manipulating property lookups during Server Action resolution.
Official Patches
Fix Analysis (2)
Technical Appendix
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HAffected Systems
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
React Server Components Meta | 19.0.0 - 19.2.0 (exclusive of patch) | 19.0.1, 19.1.2, 19.2.1 |
Next.js Vercel | 14.3.0 - 15.0.4 | 15.0.5 |
| Attribute | Detail |
|---|---|
| CVE ID | CVE-2025-55182 |
| CVSS v3.1 | 10.0 (Critical) |
| CWE | CWE-502 (Deserialization of Untrusted Data) |
| Attack Vector | Network (Pre-auth) |
| EPSS Score | 0.47368 (High) |
| Exploit Status | Active / Weaponized |
| KEV Listed | Yes (2024-12-05) |
MITRE ATT&CK Mapping
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.