What React2Shell is
React is a widely used toolkit for building websites and web apps. React Server Components are the part of it that runs on the server. React2Shell is a critical flaw in that part, made public by the React team on 3 December 2025.
In plain terms, React trusted data it should have checked. It decoded data sent to Server Function endpoints in an unsafe way (an insecure deserialization in the Flight protocol). So an attacker with no login could send one crafted web request and have React run their code on the server. This is called remote code execution (RCE). It is rated 10.0 on CVSS, a 0 to 10 severity score, which is the maximum.
It mattered so much because React Server Components are built into popular frameworks, above all Next.js with the App Router.
What was affected
Your developers can use this table to check which apps need work. It lists the affected versions and the first fixed ones.
| Component | Affected | First fix for the RCE |
|---|---|---|
| react-server-dom-webpack, -parcel, -turbopack | 19.0, 19.1.0, 19.1.1, 19.2.0 | 19.0.1, 19.1.2, 19.2.1 |
| Next.js (App Router) | 15.x, 16.x, 14.3.0-canary.77 and later | 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 |
| Other RSC frameworks | react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, rwsdk | Update to versions using fixed React packages |
Next.js 13.x, 14.x stable, the Pages Router and the Edge Runtime were not affected. One important catch: apps can be at risk even if they do not use Server Functions themselves. Google's threat intelligence team noted that just having the flawed packages installed is often enough.
The follow-up CVEs: patch again
A patch is the vendor's fix for a flaw. After the first patch, the React team found more issues in React Server Components. These are less severe: they can crash a server or expose its code. If you patched in early December 2025 and stopped there, you are still exposed to these. Each has its own CVE (the public ID number for a security flaw):
| CVE | Type | CVSS |
|---|---|---|
| CVE-2025-55183 | Source code exposure | 5.3 |
| CVE-2025-55184 | Denial of service | 7.5 |
| CVE-2025-67779 | Denial of service (incomplete fix for CVE-2025-55184) | 7.5 |
| CVE-2026-23864 | Denial of service (January 2026) | 7.5 |
How it has been exploited
Attackers moved within hours, and the attacks carried on well into 2026.
- Within hours of the news, Amazon saw China-linked groups probing and breaking into exposed servers.
- 5 December 2025: CISA, the US government's cyber defense agency, added it to its Known Exploited Vulnerabilities (KEV) list of flaws used in real attacks. Crypto mining attacks started the same day. CISA later moved the federal patch deadline forward to 12 December.
- December 2025: Google tracked several state-linked groups installing backdoors (hidden ways back in). Palo Alto Networks reported dozens of organizations breached. Attackers used tools such as Cobalt Strike and tried to steal AWS credentials.
- 2026: attacks continued. In April, Cisco Talos reported an automated campaign that breached 766 Next.js hosts in 24 hours. It stole API keys (passwords that let apps talk to other services), SSH keys, cloud credentials and Kubernetes tokens.
Many "proof of concept" exploits shared online were fake. Some carried malware aimed at researchers, so be careful what you download.
How to check and fix your apps
These steps are for your developers. In short: find the apps, update them, change any secrets that may have leaked, and check for break-ins.
- Find every app using React Server Components: check
package.jsonand lock files fornext,react-server-dom-*,react-routerand other RSC frameworks. Include internal tools and side projects. - Upgrade React Server Components packages to 19.0.4, 19.1.5, 19.2.4 or later (the fixed release for your branch). Upgrade Next.js to the latest patch of your major version. Redeploy, do not just commit.
- Rotate secrets (environment variables, API keys, database passwords and cloud credentials) if an affected app was online and unpatched at any point since early December 2025, as Vercel advised. Attacks continued into 2026, so a later patch date does not rule out theft.
- Look for signs of a break-in: unexpected programs on app servers (crypto miners, shells), new files, connections out to unknown hosts, and unusual cloud activity using the app's credentials.
- Add dependency scanning to your build pipeline (CI) so the next critical framework flaw is caught on the day it is published. See SAST vs DAST and our vulnerability management guide.
The lesson for teams using modern frameworks
Frameworks now run a lot of code on the server for you. So a flaw deep inside one can expose every app built on it. Track framework security notices the way you track operating system updates. Keep secrets out of reach of web processes where you can, and test your apps regularly. Our penetration testing services cover Next.js and React applications, APIs and the cloud behind them.
Also see PHP2Shell, the PHP remote code execution flaws exploited in October 2026.
Sources
- React: critical security vulnerability in React Server Components (3 Dec 2025)
- React: denial of service and source code exposure in RSC (updated 26 Jan 2026)
- Next.js security advisory
- Google Threat Intelligence: threat actors exploit React2Shell
- AWS Security Blog: China-nexus groups exploit React2Shell
- CISA: KEV addition (5 Dec 2025)
- BleepingComputer: automated React2Shell credential theft campaign
Need a hand with this?
Talk to a senior consultant. We reply within one business day with clear next steps and a scoped quote.
Written by
NextGarrison Security TeamPenetration testers, SOC analysts and compliance consultants
Our consultants test applications and networks, run 24/7 security monitoring and prepare companies for SOC 2, ISO 27001 and PCI DSS assessments. We write about what we see in real engagements, in plain English.