STOP CODING: React & Next.js Developers Must Patch This RCE Vulnerability

Description

There was a critical security vulnerability (CVE-2025-55182), nicknamed React2Shell, disclosed on December 3, 2025. Key Details Vulnerability: Unauthenticated Remote Code Execution (RCE). Root Cause: An unsafe deserialization flaw in the React Server Components (RSC) "Flight" protocol. Severity: Maximum CVSS score of 10.0. Impact: An attacker can execute arbitrary code on the server simply by sending a specially crafted HTTP request, even on default configurations. Affected Versions: React Server Components packages in React versions 19.0.x, 19.1.x, and 19.2.x (specifically react-server-dom-webpack, etc.). Immediate Action Required You should immediately upgrade to the patched versions if you use React Server Components or frameworks built on them, like Next.js with the App Router. Patched React: Upgrade to 19.0.1, 19.1.2, or 19.2.1 (or newer). Patched Next.js: Upgrade to the latest patched version in your release line (e.g., Next.js 15.0.5, 15.1.9, 15.2.6, etc., or newer). #React #Next.js #Developer #Security