Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution
A maximum-severity security hole has been revealed in React Server Components (RSC) that, if successfully exploited, might result in remote code execution.
The vulnerability has a CVSS score of 10.0 and is tagged as CVE-2025-55182. React2shell is the code name for the vulnerability.
In an advisory released today, the React Team stated that it exploits a vulnerability in the way React decodes payloads submitted to React Server Function endpoints, allowing unauthenticated remote code execution.
If your application supports React Server Components, it can be susceptible even if it doesn't implement any React Server Function endpoints.
The problem is a case of logical deserialization that results from processing RSC payloads in an unsafe way, according to cloud security company Wi...