React2Shell — tracked as CVE-2025-55182 (React Server Components) and CVE-2025-66478
(Next.js) — is an unauthenticated remote code execution vulnerability with a CVSS score of 10.0.
A single HTTP request, with no login and no browser, can run arbitrary code on a vulnerable server.
It has been actively exploited in the wild to drop cryptominers and steal cloud credentials.
How it works, in one paragraph
React Server Components serialize data between server and client using an internal format called the
"Flight" protocol. On affected versions, sending a request with a next-action header routes
it into a deserializer that rebuilds attacker-controlled objects without validating their types.
A crafted payload walks JavaScript's prototype chain (constructor.constructor) to reach the
Function constructor — JavaScript's eval twin — and wraps it in a "thenable" that the runtime
automatically resolves. The moment the server deserializes the data, it runs the code. No Server
Action in your own code is required; the surface exists in any default App Router app.
Am I affected?
You are affected if you run an unpatched Next.js version — the 15.1.x line is vulnerable, and the
flaw spans other 15.x/16.x ranges (see the official advisory).
Two things worth knowing:
- "Clean code" does not protect you. The vulnerability is in the framework, not your routes.
- A reachable action endpoint alone does not prove exploitability — a patched site also responds
to the probe. The reliable signal is your Next.js version.
How to fix it
- Upgrade Next.js to the patched release for your line (e.g. 15.5.20 on 15.x, or the latest
16.x). This closes the RCE. - Rotate secrets if you were online and unpatched — the exploit can read your process environment,
so treat any database, API, or provider key the app holds as exposed. - Scope secrets per service so a front-end container never holds your database or payment keys —
that turns a future framework RCE from "data breach" into a shrug. - Default-deny egress on app containers so a successful RCE cannot download a second stage or beacon out.
Check your site now
Not sure whether your version is patched? Run a FrameScan scan: verify you own the domain,
and we fingerprint your stack, flag React2Shell and other known CVEs, and hand you the exact fix — in
minutes, for $1.