React2Shell: RCE Vulnerabilities Require Immediate Attention

As reported by React and .js and titled react2shell , a new unauthenticated remote-code-execution vulnerability has been disclosed in React Server Components.

Assigned CVE-2025-55182 and CVE-2025-66478 , the issues carry a Critical CVSS score , the highest category, due to their trivial exploitability and the ubiquity of React in modern web applications. Sonatype customers will have received automated notifications of any applications containing these components through continuous monitoring.

Like Log4Shell, this is fundamentally a deserialization-of-untrusted-data flaw . React’s server-side request decoding logic unsafely deserializes attacker-controlled inputs. This allows arbitrary code execution in applications using React Server Components, even if the application doesn’t explicitly expose Server Function endpoints.

Given the enormous global footprint of React and .js (the collective weekly download volume according to npmjs is nearly 1B/week), and the increasing adoption of server-side React patterns, the scope of this RCE vulnerability is significant.

The vulnerable React packages (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) perform unsafe property access when reconstructing server function metadata. Versions 19.0.0 , 19.1.0 , 19.1.1 , and 19.2.0 , as well as many canary, rc, and experimental versions, are affected. .js versions >=14.3.0-canary.77, >=15, >=16 are affected.

Even if your app does not implement any React Server Function endpoints, it may still be vulnerable if your app supports React Server Components.

A crafted HTTP payload can inject metadata pointing to dangerous prototype-chain properties. When React resolves the server function call, the deserializer exposes access to bundled modules. This turns a single HTTP request into full RCE with no authentication and no user interaction required.

You are affected if you use any of the following vulnerable packages :

react-server-dom-webpack

19.0.0, 19.1.0, 19.1.1, 19.2.0

react-server-dom-parcel

19.0.0, 19.1.0, 19.1.1, 19.2.0

react-server-dom-turbopack

19.0.0, 19.1.0, 19.1.1, 19.2.0

≥14.3.0-canary.77, < 14.3.0-canary.88, 15.x, and 16.x

Sonatype also identified thousands of canary, release candidate, beta, , and experimental versions that contained the vulnerable functionality.

You are also affected if you rely on frameworks that embed these, including: .js ≥14.3.0-canary.77, < 14.3.0-canary.88, 15.x, 16.x; React Router; Waku; Redwood; Vite RSC plugin; Parcel RSC.

Our internal data already shows usage of affected package versions across the ecosystem. Detection signatures are now available in all of our Sonatype Nexus One Platform products. Any customer scanning affected applications will receive alerts automatically for these vulnerabilities.

We have already seen several requests we believe are attempting to exploit this vulnerability, but Sonatype upgraded to non-vulnerable versions and redeployed any affected SaaS systems yesterday and products remain unimpacted.

Mitigation is possible via Web Application Firewalls (WAFs), which are already deployed in most products.

To remediate the RCE vulnerability, you need to upgrade React and .js to fixed versions. Patched versions include:

19.0.1, 19.1.2, 19.2.1

14.3.0-canary.88, 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7

The affected versions have been deprecated in npmjs and are no longer browseable.

Sonatype Lifecycle and Sonatype Repository Firewall provide:

Powered by Sonatype's unmatched open source intelligence, Sonatype Nexus One is the only platform purpose-built to protect developers in the AI era. As developers increase their use of AI coding assistants, these tools will continue to recommend vulnerable or outdated packages. Sonatype's MCP Server helps by intercepting insecure components before they ever reach developers. Without this level of protection, teams are always at risk of importing vulnerabilities like React2Shell.

Even if you don’t think you use server functions, update immediately — frameworks may include vulnerable components transitively.

CVE-2025-55182 is one of the more severe JavaScript-ecosystem vulnerabilities we’ve seen and utilizes:

These features make this a high-urgency event. As with Log4Shell, early indications show scanning activity beginning quickly, and exploit code is already publicly available on GitHub.

If you need help validating your exposure, Sonatype Lifecycle will identify vulnerable versions immediately.