Mar 19
Loading video player...
In episode one of our Armada webcast series on the React2Shell vulnerability, we break down CVE-2025-55182—a critical, maximum-severity (CVSS 10.0) remote code execution (RCE) flaw impacting React Server Components and frameworks like Next.js. React2Shell represents a worst-case scenario for web application security: an unauthenticated RCE vulnerability stemming from insecure deserialization within the React "Flight" protocol. By sending a single, specially crafted HTTP request, an attacker can bypass authentication entirely and execute arbitrary code on the underlying server. In this episode, we cover: • The technical mechanics of the unsafe deserialization flaw in the Flight data-handling logic. • How attackers exploit Promise-like objects during hydration to achieve code execution under the Node.js runtime. • The immediate impact on default configurations of Next.js and the widespread, automated exploitation observed in the wild. • The shift from opportunistic scanning to active deployment of post-exploitation payloads, including cryptominers and Linux backdoors. • Understanding the root cause of React2Shell is the critical first step for security and development teams needing to audit, patch, and protect their React 19 and Next.js environments. To learn more about how the Armada team at risk3sixty tracks and defends against critical zero-day vulnerabilities, visit our website: https://risk3sixty.com/armada #React2Shell #CVE202555182 #CyberSecurity #AppSec #ReactJS #NextJS #InfoSec #risk3sixty #Armada #ArmadaOps