# Find and Fix React2Shell

## CVE-2025-55182 & CVE-2025-66478

**Additional insights:**

- [React2Shell: RCE Vulnerabilities Require Immediate Attention](/content/blog/react2shell-rce-vulnerabilities-require-immediate-attention/index.html): Overview of the React2Shell RCE issue, why it matters, and what teams should do immediately to reduce risk.
- [Three New React Vulnerabilities Surface on the Heels of React2Shell](/content/blog/three-new-react-vulnerabilities-surface/index.html): Summary of additional React Server Components vulnerabilities disclosed after React2Shell, with context on which CVEs are separate from React2Shell.

**Serious remote code execution (RCE) vulnerabilities in React Server Components require immediate attention.**

On December 3, 2025, a critical unauthenticated remote code execution (RCE) vulnerability was disclosed in React Server Components. Dubbed “React2Shell” by the community, these vulnerabilities (CVE-2025-55182 and CVE-2025-66478) carry a CVSS score of 10.0.

Much like Log4Shell, this is a fundamental deserialization flaw where attacker-controlled input is unsafely processed, allowing arbitrary code execution without authentication or user interaction. Given the ubiquity of React and Next.js—present in more than a third of cloud environments—the blast radius is significant.

This guide outlines the mechanics of the vulnerability, how to determine if you are affected, and how to use the Sonatype Nexus platform to detect and block these components immediately.

## Understanding React2Shell

The core of the vulnerability lies in the request decoding logic of React Server Components (specifically the "Flight" protocol). When a server processes a request, it must reconstruct metadata to invoke a server-side function. In vulnerable versions, the deserializer performs unsafe property access on this metadata.

An attacker can craft a malicious HTTP payload that injects metadata pointing to dangerous prototype-chain properties. When React resolves this call, it exposes access to bundled modules, effectively allowing the attacker to trigger RCE.

The issue stems from insecure deserialization in the RSC Flight protocol. The payload is not validated correctly, which allows attacker-controlled metadata to influence server-side execution logic.

### Key Risk Factors

- **No Authentication Required**: Attackers can exploit this remotely without logging in or needing prior authorization.
- **Trivial Exploitation**: Exploitation requires only a specially crafted HTTP request. Testing has shown a near-100% success rate.
- **Public Exploit Code Available**: Proof-of-concept exploit code is already publicly available, increasing the likelihood of rapid exploitation.
- **No Explicit Endpoints Needed**: Even if your application does not explicitly expose Server Function endpoints, the presence of vulnerable React Server Component logic is sufficient for exploitation.
- **Default Configuration Risk**: A standard Next.js application built for production can be exploited with no code changes by the developer.

## Are You Affected?

You are likely affected if your application uses React Server Components, specifically versions **19.0.0 through 19.2.0** of the following packages:

- react-server-dom-webpack  
- react-server-dom-parcel  
- react-server-dom-turbopack

### Framework Impact

Because these packages are often embedded, users of major frameworks are also at high risk. You are likely affected if you use any of the following:

- **Next.js Versions**  
  - ≥14.3.0-canary.77 **and** <14.3.0-canary.88  
  - 15.x  
  - 16.x

- **Other Ecosystems**  
  - React Router  
  - Waku  
  - Redwood  
  - Vite RSC plugin  
  - Parcel RSC

Because many organizations deploy Next.js applications publicly, the potential attack surface for React2Shell is significant and ongoing.

**Note**  
If you are running any of these versions, assume you are vulnerable until proven otherwise.

## How to Detect React2Shell with Sonatype

Sonatype has onboarded detection signatures for **CVE-2025-55182** and **CVE-2025-66478** into our data services. These signatures are now available across the Sonatype Nexus One Platform. Note that Lifecycle and Firewall will currently provide a different numerical CVSS score to CVE-2025-55182 than you may be expecting; see our [Support knowledgebase article](https://support.sonatype.com/hc/en-us/articles/47198596770323-Why-does-CVE-2025-55182-have-CVSS-9-3-and-Not-10) for a detailed explanation.

**Improved JavaScript Scanning as of December 16, 2025**  
On December 16, 2025, Sonatype made improvements that enhanced our JavaScript analysis capabilities so that we can now detect previously obscured JavaScript dependencies. For more information, see [our Knowledgebase article](https://support.sonatype.com/hc/en-us/articles/47423166321555).

These improvements do not require an update to Lifecycle. All new scans, including automated scans through Lifecycle’s CI/CD integrations, will automatically include these improved results.

To immediately extend improved reporting coverage to all existing reports, we recommend configuring and then [manually triggering continuous monitoring](https://help.sonatype.com/en/continuous-monitoring.html#manually-triggering-the-continuous-monitoring-task-162337).

After running a fresh scan, you can use Advanced Search to quickly search by `vulnerabilityId` to see if any vulnerable components were detected:

```
vulnerabilityId:CVE-2025-55182 OR vulnerabilityID:CVE-2025-66478
```

### Step 1: Scan with Sonatype Lifecycle

Sonatype Lifecycle provides real-time SBOM awareness and precise component identification.

1. **Run a fresh scan** of your applications immediately by manually triggering the continuous monitoring tasks as described in [our help documentation](https://help.sonatype.com/en/operational-menu.html#triggering-continuous-monitoring).
2. Navigate to your **Application Composition Report**.
3. Filter for **Security Vulnerabilities** with a CVSS score of 10.0; or, search specifically for **CVE-2025-55182**.
4. Review the _Dependency Tree_ to identify if the vulnerable `react-server-dom-*` packages are present as direct **or transitive** dependencies.

### Step 2: Continuous Monitoring

#### If you have configured Continuous Monitoring

You do not need to manually rescan every build. Sonatype has likely already sent automated notifications to the configured contact owners for any application currently using these components. Check your alerts and notifications dashboard for immediate hits.

#### If you have not configured Continuous Monitoring

Use this event as an opportunity to enable it for your applications. React2Shell affects widely used components found in countless modern web applications. By enabling Continuous Monitoring, you ensure that Sonatype Lifecycle automatically alerts you to severe risks in your software inventory the moment they are onboarded to our data, eliminating the gap between disclosure and detection.

### React2Shell Impact Filter in the _Security Risk Breakdown_ Dashboard

Sonatype has added a dedicated _React2Shell Impact_ filter to the [Security Risk Breakdown dashboard](https://help.sonatype.com/en/security-risk-breakdown.html "Security Risk Breakdown") Enterprise Dashboard, which is available under _Enterprise Reporting_ in the user interface. This filter allows you to determine whether React2Shell affects any applications across your organization.

The filter includes the following selectable options:

- _Has Impact_ – Applications containing vulnerable React Server Component packages.
- _No Impact_ – Applications with no identified exposure.

The filter defaults to _is any value_, allowing you to review all applications before narrowing the view.

If your organization has not been affected, the _Has Impact_ option will not appear in the filter.

This provides a centralized, portfolio-wide view of React2Shell exposure and helps teams quickly identify which applications require remediation.

## How to Block and Mitigate

The following short-term protections are available to reduce immediate risk, including preventing vulnerable components from re-entering your builds. These measures are supplemental; upgrading to patched versions is still required.

### Available Vendor-Provided Web Application Firewalls (WAFs)

Several providers have released rules to help block known React2Shell exploitation patterns. While Web Application Firewalls (WAFs) can offer some mitigation, they are often temporary measures. The only robust remediation is upgrading the vulnerable components.

#### WAF for AWS

If you are running on AWS, Amazon has released a WAF rule to help block known exploitation attempts. Ensure your environment is using **version 1.24 or later** of the [AWSManagedRulesKnownBadInputsRuleSet](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html#aws-managed-rule-groups-baseline-known-bad-inputs). This rule adds initial protection at the perimeter but should be treated as a temporary mitigation, not a replacement for upgrading affected components.

[See Amazon's post](https://aws.amazon.com/security/security-bulletins/rss/aws-2025-030/) for additional details and instructions for if you are on an older version.

#### WAF for Cloudflare

All Cloudflare customers are automatically protected, including those on free and paid plans, as long as their React application traffic is proxied through the Cloudflare Web Application Firewall (WAF).

See [Cloudflare's post](https://blog.cloudflare.com/waf-rules-react-vulnerability/) for additional details.

### Block Bad Components with Sonatype Firewall

To prevent developers from accidentally introducing these versions or breaking builds during remediation, use Sonatype Firewall to block these artifacts at the proxy level.

1. **Review your Security Policies**: Ensure you have a policy in place that fails builds or quarantines components with **Critical (CVSS >= 9)** vulnerabilities.
2. **Verify Blocking**: Navigate to your Repository Manager. Confirm that versions of react-server-dom-webpack (and related packages) between **19.0.0 – 19.2.0** are blocked from being downloaded.
3. **Quarantine**: Firewall will automatically quarantine these components preventing future downloads. This prevents new exploitable builds from ever entering pipelines—even before developers know the CVE exists.

## Remediate the Codebase

Developers must upgrade to the fixed versions immediately. The affected versions have been deprecated on npmjs.

Update to the following patched versions:

| Component | Fixed Versions |
| --- | --- |
| React | 19.0.1, 19.1.2, 19.2.1 |
| Next.js | 14.3.0-canary.88, 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 |

**Note**  
If you are using other frameworks (like Waku or Redwood), check their specific advisory pages for the corresponding patched release.

## Summary and Next Steps

React2Shell is a high-urgency event due to the combination of zero authentication, trivial exploitation, and massive adoption.

**Immediate Checklist**

1. **Scan**: Use Sonatype Lifecycle to identify exposure in your applications.
2. **Block**: Ensure Sonatype Firewall is blocking the vulnerable versions (19.0.0 - 19.2.0).
3. **Patch**: Upgrade React and Next.js to the fixed versions listed above.

Sonatype's data research team is continuously monitoring this situation. As new vectors or bypasses are discovered, our data will be updated automatically.