React2Shell (CVE-2025-55182)

React Server Components let a React app run code on the server and stream the results to the browser in an internal format called Flight. React2Shell is an unsafe-deserialization bug in how React decodes Flight payloads sent to Server Function endpoints: one crafted HTTP request, with no login, runs commands on the server. The bug is in the react-server-dom packages, so frameworks built on them, including Next.js, React Router and Waku, inherited it. Lachlan Davidson reported it.

Exploitation began within hours of disclosure in early December 2025. Amazon saw attempts from infrastructure tied to the China-nexus groups Earth Lamia and Jackpot Panda, Palo Alto Networks' Unit 42 confirmed more than 30 affected organisations, and botnets and cryptominers piled in once public exploits appeared. CISA added it to KEV on 5 December 2025.

The fixed packages are 19.0.1, 19.1.2 and 19.2.1, and frameworks shipped their own updates, so update the framework, not just React. The lesson for developers: features that pass objects from the browser to the server are an attack surface, and when a framework you depend on has a 10.0 bug, your app is exposed even if your own code is flawless.