Check your app for React2Shell.
Test an authorized website for React2Shell, the critical React Server Components vulnerability tracked as CVE-2025-55182 and CVE-2025-66478 in Next.js. Launch SmartScanner with your target ready to check.
Check an authorized target
Enter its URL to open SmartScanner on your Windows computer.
In SmartScanner, select Next.js Tests and start the scan. Only scan systems you own or have permission to test.
A targeted check for the React2Shell security issue
Know what you are testing
What is the React2Shell vulnerability?
React2Shell is a critical, unauthenticated remote code execution flaw in server-side React Server Components and Server Functions. Affected Next.js deployments track the issue as CVE-2025-66478; the React vulnerability is CVE-2025-55182.
A site using React is not automatically vulnerable. Exposure depends on whether it uses affected server-side functionality and vulnerable package versions. SmartScanner helps you test a running, authorized application; update affected dependencies to patched releases and scan again to verify.
Start a React2Shell check
- 01
Enter your target URL
Use a public website or test environment you are authorized to assess.
- 02
Choose Next.js Tests
SmartScanner opens on Windows with your target URL ready. Select Next.js Tests in the scan settings.
- 03
Review findings and remediate
Check the scan results, update affected React or Next.js packages, then run the test again.
Built for a clear next step
Test locally. Keep control of your scan.
No cloud scanner account or upload step. SmartScanner runs on your Windows computer, so you can test your authorized target and review results locally.
Start with the exact URL
The target you enter is passed to the desktop app, ready for a focused check.
Run the relevant test
Select Next.js Tests in SmartScanner to check for the React2Shell issue.
Act on the result
Use the finding to prioritize updates, then retest after remediation.
A scan is one part of remediation. Confirm affected packages and apply the vendor-recommended patched versions. See the React2Shell vulnerability details and the React security advisory.
Command-line scanning
Test one URL or a list of URLs.
Use the SmartScanner CLI (sms.exe) to run a focused React2Shell check from Windows Command Prompt. The fingerprint test checks for Next.js before the React2Shell test runs.
Scan one authorized website
Open Command Prompt where SmartScanner is installed, then replace the example URL with a target you own or are authorized to test.
sms.exe -t React2Shell -t fingerprint -u https://staging.example.comThis runs framework fingerprinting and triggers the React2Shell check when Next.js is detected.
Scan a list of authorized URLs
Create a text file with one authorized URL per line, for example C:\security\react-apps.txt:
https://staging.example.com
https://app.example.comRun the CLI against the input URLs. --no-follow keeps the scan to the URLs in your file rather than following discovered links.
sms.exe -t React2Shell -t fingerprint --no-follow -f C:\security\react-apps.txtThe SmartScanner CLI is included with the Windows application. Only scan systems you own or have explicit permission to test. See the full React2Shell CLI guide for more options.
React2Shell scanner FAQ
Questions before you scan
Which vulnerabilities does this check cover?
SmartScanner's Next.js Tests include a check for React2Shell, associated with CVE-2025-55182 in React and CVE-2025-66478 in Next.js.
Does entering a URL run the test automatically?
Entering a URL opens SmartScanner on Windows with the target ready. Select Next.js Tests in the app, then start the scan.
Is SmartScanner an online scanner?
The scan runs locally in the SmartScanner Windows app, not on a hosted scanner. Scan requests and results stay on your computer.
Can I scan any website?
Only scan systems you own or have explicit permission to test. For third-party systems, get authorization before running any security test.
What should I do if a scan finds React2Shell?
Follow the vendor guidance to update affected React Server Components or Next.js packages to patched releases. Then retest to check your application again.
Check your authorized application
Get a React2Shell security signal.
Launch SmartScanner on Windows, select Next.js Tests, and review the result. No account required to start.