CVE-2025-55182: React2Shell Explained

CVE-2025-55182 is a newly disclosed critical vulnerability (CVSS 10.0) affecting React Server Components (RSC), enabling attackers to execute arbitrary code on vulnerable servers with minimal effort. Cloud providers such as AWS have already observed active exploitation attempts, and security vendors expect large-scale exploitation. 

This article outlines what organisations need to know now: how the vulnerability works, how to identify exposure, and the immediate steps required to mitigate risk. It also provides cloud-specific guidance for teams running React applications on Azure and AWS, including how each platform’s Web Application Firewall (WAF) is responding to the threat. 

Finally, the article highlights how Blacklock can reduce long-term exposure to emerging threats like CVE-2025-55182

What Is CVE-2025-55182?

Published last December 4 (NZST), CVE-2025-55182 is a critical vulnerability affecting React Server Components. It allows attackers to send crafted component streams that bypass validation in the server-side rendering pipeline, resulting in arbitrary code execution on the underlying server.

Here are some key characteristics of the vulnerability:

• Critical Pre-authentication Remote Code Execution (RCE): The vulnerability allows an attacker to execute arbitrary code on the server without needing credentials or an active session. It has been assigned the maximum CVSS score of 10.0, highlighting its critical nature.
• Affects RSC: The flaw is rooted in the RSC architecture, specifically within the server-side handling of communication between the client and server components.
• Root Cause: Unsafe Deserialization: The mechanism that enables the RCE is the server's unsafe handling (deserialization) of the streamed inputs (RSC payloads). This allows a specially crafted, malicious payload to be interpreted as executable logic (arbitrary code).
• Server-Side Origin: The flaw is in the server-side rendering logic of React Server Components, not in the client-side React code.

Broad Impact: It affects applications using React Server Components in various versions of the react-server-dom-* packages, and consequently impacts popular frameworks and bundlers that rely on it, most notably Next.js, especially when using the App Router. Even apps that mostly use client-side React but rely on any Server Components can be exposed.

Why CVE-2025-55182 Is Critical

The severity of CVE-2025-55182 comes not only from its potential to enable pre-auth RCE (refer to the first bullet point above) but also from how easily it can be exploited and the scale of impact once compromised.

Why this vulnerability is uniquely dangerous

• Pre-authentication RCE: Attackers don’t need credentials, making it ideal for broad, automated exploitation campaigns.
• Internet-facing exposure: Many React applications using Server Components are deployed publicly, significantly increasing the attack surface.
• Low exploit complexity: Crafting malicious component streams does not require deep framework knowledge once proof-of-concept (PoC) exploits circulate.
• High-impact execution: Successful exploitation grants full server-level access, enabling lateral movement, data exfiltration, supply-chain compromise, or persistent access.
• Rapid real-world weaponisation: Cloud providers have observed state-linked groups scanning for and exploiting vulnerable applications at scale, confirming that this is not a theoretical risk but an active threat.

Read More: Blacklock Security Achieves CREST Accreditation

How to Identify If Your Application Is Vulnerable

Because CVE-2025-55182 affects the server-side handling of React Server Components, teams should focus on determining whether their application uses RSC features directly or indirectly, and whether any vulnerable versions of the underlying packages are in use.

Key indicators that your application may be exposed

• Your application uses React Server Components or a framework that enables them by default (e.g., Next.js App Router).
• You are running versions of react-server-dom-* that were published before patched releases became available.
• Your build pipeline generates or consumes RSC payloads, even if the majority of your UI is client-side.

Observable signs of attempted exploitation

• Unexpected or malformed RSC stream requests appearing in server logs.
• Sudden spikes in error logs related to server component decoding.
• Requests containing unusual serialized payload structures consistent with known PoC patterns.

Recommended ways to verify exposure

• Review dependency manifests (e.g., package.json) for affected package versions.
• Use SBOM or dependency-scanning tools to identify vulnerable React packages.
• Run targeted DAST scans to detect unsafe RSC endpoints or behaviours.

Recommended Mitigation Strategies

Once you confirm that your application may be affected by CVE-2025-55182, initiate mitigation efforts immediately. Here are some tips you can apply.

Immediate steps to reduce exposure

• Upgrade to patched React and react-server-dom-* versions as soon as they are released.
• Redeploy builds using patched dependencies to ensure no vulnerable artefacts remain in production.

Rotate credentials, secrets, and tokens if you suspect exploitation. Although an attacker won’t need credentials to exploit CVE-2025-55182, it would be able to obtain credentials after exploiting the said vulnerability.

Application-level remediation

• Disable or limit RSC features if they are not essential to your application.
• Isolate server-side rendering components into restricted execution environments where possible.
• Implement strict input validation on any custom RSC handlers or extensions.
  

Infrastructure and pipeline hardening

• Enable continuous dependency scanning to flag vulnerable versions early.
• Integrate SBOM-based checks into CI/CD to detect React package regressions.
• Apply least-privilege permissions to servers and containers to minimise blast radius if compromise occurs.

Read More: Guide to SBOM: What It Is and Why It Matters?

Protecting React Applications on Azure and AWS

The following table summarises how both major cloud providers are responding to CVE-2025-55182, along with practical steps organisations can apply when hosting React applications on these platforms.

How Blacklock Can Help Organisations Identify & Prevent CVE-2025-55182

As vulnerabilities such as CVE-2025-55182 demonstrate, organisations need the ability to identify, validate, and remediate risks quickly, especially when critical flaws arise in widely deployed frameworks like React. 

Blacklock supports those efforts by providing a vulnerability identification in our continuous DAST scanning. We have developed a PoC code and included in our DAST scanner, by default.

Blacklock also provides AI-assisted fix guidance aligned to the application’s technology stack, along with Automated Security Validation, enabling developers to self-retest vulnerabilities after applying a fix. This accelerates remediation cycles and ensures that high-risk issues, such as unsafe server-side deserialization or dependency-level defects, are resolved and verified promptly.