React2Shell: The Critical RCE Vulnerability in React Server Components (CVE-2025-55182)

React2Shell: The Critical RCE Vulnerability in React Server Components (CVE-2025-55182) A CVSS 10.0 vulnerability that every Next.js and React developer needs to understand—and patch immediately. Why This Matters On December 3, 2025, the React team disclosed a critical unauthenticated remote code execution (RCE) vulnerability in React Server Components. With a CVSS score of 10.0 (the maximum possible severity), this flaw allows attackers to execute arbitrary code on your server without any authentication. If you're using Next.js 15.x, 16.x, or any framework that leverages React Server Components with the App Router, your application may be vulnerable right now . Proof-of-concept exploits are publicly available, and threat actors have already been observed exploiting this in the wild. The vulnerability has been dubbed "React2Shell" by the security community—a nod to the infamous "Shellshock" vulnerability, reflecting its severity and ease of exploitation. Understanding the Vulnerability