Description
React2Shell is a critical unauthenticated remote code execution vulnerability affecting server-side usage of React Server Components and React Server Functions. The issue arises from a flaw in how React deserializes and decodes attacker-controlled payloads sent to Server Function endpoints. A maliciously crafted HTTP request can be interpreted as executable server-side code during deserialization, allowing attackers to achieve arbitrary code execution without authentication. In Next.js, this vulnerability is tracked separately as CVE-2025-66478 due to React being vendored rather than declared as a direct dependency.
Recommendation
Immediately upgrade all affected React and framework packages to patched versions. For React Server Components, upgrade to react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack versions 19.0.1, 19.1.2, 19.2.1, or later. Next.js users must upgrade to the latest patched release in their supported release line. Do not rely on temporary hosting-provider mitigations or WAF rules. If React Server Components or Server Functions are not required, consider disabling or removing server-side React functionality entirely.
References
Could your website be exposed too?
SmartScanner can check your website for React2Shell (CVE-2025-66478) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- react-native-keys insecurely stores encryption cipher and Base64 chunks - CVE-2025-45001
- @clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/react-router - CVE-2025-53548
- The AuthKit React Router Library rendered sensitive auth data in HTML - CVE-2025-55008
- React Router has XSS Vulnerability - CVE-2025-59057
