React2Shell: React Server Components RCE

Why This Case Matters

The React team disclosed CVE-2025-55182 on December 3, 2025. It is an unauthenticated remote-code-execution vulnerability in the way React Server Components decode payloads sent to Server Function endpoints. Applications may be affected when they support React Server Components even if they do not explicitly define Server Functions.

This entry is a research candidate, not a reproduced exploit. It establishes an evidence plan without publishing an unverified payload.

Affected Surface

The original React advisory identifies these packages and vulnerable releases:

• react-server-dom-webpack 19.0, 19.1.0, 19.1.1, and 19.2.0
• react-server-dom-parcel 19.0, 19.1.0, 19.1.1, and 19.2.0
• react-server-dom-turbopack 19.0, 19.1.0, 19.1.1, and 19.2.0

Framework users should inspect the resolved dependency tree rather than checking only the top-level react version.

Required Remediation

Upgrade affected packages immediately. The original RCE fix was released in 19.0.1, 19.1.2, and 19.2.1. React subsequently disclosed additional denial-of-service and source-exposure issues in the same packages, so current deployments should follow the latest React guidance and use a fully patched supported release rather than stopping at the first RCE-only patch.

Primary sources:

• React: Critical Security Vulnerability in React Server Components
• React: Follow-up denial-of-service and source-exposure advisory

Defensive Research Plan

The lab should answer these questions:

1. Which framework configurations expose a reachable React Server Function transport?
2. What stable request properties remain after framework and hosting-provider normalization?
3. What application, runtime, and process telemetry exists before and after successful exploitation?
4. Can a detection distinguish malformed serialized payloads from legitimate Server Function traffic without logging sensitive request bodies?
5. Does the latest patched version reject the same test while preserving legitimate application behavior?

Current Evidence Gap

No authorized lab reproduction, detection artifact, or before-and-after evidence is attached. Only the vendor-backed mitigation is considered covered.