⚠ī¸ Warning ⚠ī¸ Deprecated Code! This video tutorial contains outdated code.
💡 If you wish to update it, any AI assistant will update the code for you in seconds.

React and Next.js Developers Must Patch This RCE Vulnerability

Published : December 16, 2025   •   Last Edited : December 16, 2025   •   Author : Adam Khoury

There was a critical security vulnerability (CVE-2025-55182), nicknamed React2Shell, disclosed on December 3, 2025.

Key Details

Vulnerability: Unauthenticated Remote Code Execution (RCE). Root Cause: An unsafe deserialization flaw in the React Server Components (RSC) "Flight" protocol. Severity: Maximum CVSS score of 10.0. Impact: An attacker can execute arbitrary code on the server simply by sending a specially crafted HTTP request, even on default configurations. Affected Versions: React Server Components packages in React versions 19.0.x, 19.1.x, and 19.2.x (specifically react-server-dom-webpack, etc.).

Immediate Action Required

You should immediately upgrade to the patched versions if you use React Server Components or frameworks built on them, like Next.js with the App Router. Patched React: Upgrade to 19.0.1, 19.1.2, or 19.2.1 (or newer). Patched Next.js: Upgrade to the latest patched version in your release line (e.g., Next.js 15.0.5, 15.1.9, 15.2.6, etc., or newer).
▲