sylvie.fyi Critical React2Shell RCE Vulnerability Disclosed by Meta
Article Content
- •CVE-2025-55182 is a critical RCE vulnerability in React Server Components.
- •The vulnerability affects millions of websites and was disclosed by Meta on December 3, 2025.
- •Developers are urged to apply patches immediately to prevent exploitation.
On December 3, 2025, Meta disclosed CVE-2025-55182, a critical remote code execution vulnerability dubbed React2Shell, affecting React Server Components. The flaw arises from improper type validation in the Flight protocol, allowing attackers to construct arbitrary code execution paths. This vulnerability potentially impacts millions of websites using React. The initial discovery was made by Lachlan Davidson on November 30, 2025, while he was investigating the Flight protocol. Meta released a fix shortly after the disclosure, urging developers to update immediately. The first public proof of concept (PoC) was shared on December 19, 2025, indicating the vulnerability's exploitability. Security professionals are advised to prioritize patching affected systems to mitigate risks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track React2Shell, Meta and CVE-2025-55182 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Novo Nordisk Data Breach Exploits Hardcoded GitHub Tokens Novo Nordisk suffered a data breach linked to the cyber extortion group FulcrumSec, which exploited hardcoded credentials found in client-side JavaScript across two subdomains. The attackers accessed over 1 terabyte of sensitive data, including experimental drug data and customer records, after gaining entry in June… 
Langflow AI Platform Targeted by RCE Exploitation In September 2026, the Langflow AI application-building platform faced significant exploitation attempts targeting CVE-2026-0768, an unauthenticated remote code execution vulnerability. F5 Labs reported 405 requests from 55 distinct source IPs, indicating a coordinated effort to exploit this flaw. The vulnerability…