CVE-2025-55182: React2Shell RSC RCE

CVE-2025-55182 is unauthenticated remote code execution in React Server Components (RSC) payload decoding. React confirmed the decoder flaw; Google Threat Intelligence later documented campaigns deploying downloaders, backdoors, and miners.^{[1], [4], [5]}

💡 Plain English Explainer (ELI5)

Imagine a receptionist checking an approved service directory. A faulty lookup treats a name inherited from the directory template as if the owner had registered it. React’s patch checks that a requested module export is an entry on that module itself; the public advisory does not disclose the full exploit sequence. Upgrade affected packages.^[1]

Core Concepts & Subsystem Terms

React Server Components (RSC): React Server Components: React protocol and packages for server rendering and Flight-data exchange.^[1]

Framework mappings

CWE reference for the weakness described in this guide: CWE-502
CISA KEV — added 2025-12-05 — CVE-2025-55182

Root Cause Analysis

React confirms the RCE came from a flaw decoding payloads sent to React Server Function endpoints; RSC support alone could expose an app. The initial advisory withheld deeper exploit details. The public upstream patch adds an own-property check before resolving a client-module export in requireModule(), and hardens multipart reply error handling. This excerpt shows a concrete patch change; it is not a full decoder reproduction or a claim that one guard explains the entire exploit chain.^{[1], [2]}

React2Shell affected versions and deployment scope

Component or deployment	Scope assessment	Remediation action
`react-server-dom-webpack`, `react-server-dom-parcel`, or `react-server-dom-turbopack` at 19.0, 19.1.0, 19.1.1, or 19.2.0.	Affected server-side RSC support can expose an application even when it does not define a Server Function endpoint; the server boundary must be reachable.	Upgrade the package line to 19.0.1, 19.1.2, or 19.2.1 or later, as applicable. Rebuild and redeploy the server artifact.
Next.js App Router on affected 15.x/16.x releases or 14.3.0-canary.77 and later canaries.	Affected framework integrations bundle the vulnerable RSC packages. Do not infer safety from the app not declaring its own Server Function endpoint.	Use the matching patched line: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, or 16.0.7 or later. These are the minimum releases recorded by the cited advisory; check the current vendor branch before rollout.
Client-only React application with no server-side RSC support.	Outside the documented CVE scope because it has no server-side decoder boundary.	No React2Shell server patch is needed for this configuration. Reassess if RSC or a server component is introduced.
Deployment reported as patched.	A manifest version alone does not prove that every running region, preview service, worker, or container uses the fixed artifact.	Verify deployed image digests and resolved package versions across production, preview, and worker environments; investigate any earlier exposed interval.
Next.js release-line guidance in React’s update dated 2026-01-26	React’s later guidance includes newer security releases; these are not the minimum versions that first fixed `CVE-2025-66478`. Companion RSC advisories and supported branches can change the rollout target.	For related RSC advisories `CVE-2025-55183`, `CVE-2025-55184`, `CVE-2025-67779`, and `CVE-2026-23864`, React listed fixed package versions 19.0.4, 19.1.5, and 19.2.4. Its Next.js guidance dated 2026-01-26 was: 14.2.35 for 13.3.x–14.x stable; 15.0.8 for 15.0.x; 15.1.12 for 15.1.x; 15.2.9 for 15.2.x; 15.3.9 for 15.3.x; 15.4.11 for 15.4.x; 15.5.10 for 15.5.x; 16.0.11 for 16.0.x; and 16.1.5 for 16.1.x. These are later guidance for related issues, not the minimum Next.js releases that fixed `CVE-2025-66478`. Check the latest vendor advisory and supported release line before deploying.
`CVE-2026-23869` — RSC denial of service (2026-04-08).	React reports crafted HTTP requests to Server Function endpoints can consume excessive CPU for up to a minute before a catchable error. Affected `react-server-dom-*` package lines end at 19.0.4, 19.1.5, and 19.2.4.	React lists 19.0.5, 19.1.6, and 19.2.5 as fixed, respectively.
`CVE-2026-23870` — RSC denial of service (2026-05-06).	React reports crafted HTTP requests can cause out-of-memory exceptions or excessive CPU use. The affected `react-server-dom-*` package lines end at 19.0.5, 19.1.6, and 19.2.5.	React lists 19.0.6, 19.1.7, and 19.2.6 as fixed, respectively.
`CVE-2026-44907` — Server Functions denial of service (2026-07-21).	React reports crafted HTTP requests can cause out-of-memory exceptions or excessive CPU use. The affected `react-server-dom-*` package lines end at 19.0.7, 19.1.8, and 19.2.7.	React lists 19.0.8, 19.1.9, and 19.2.8 as fixed, respectively.

Step-by-Step Attack Flow

Step 1

An exposed RSC boundary accepts an unauthenticated request

React states that RSC support can leave an application affected even when it does not define a Server Function endpoint. Client-only React apps without a server are outside this CVE.^{[1], [4]}

Step 2

A crafted request reaches the vulnerable reply decoder

The vendor describes unsafe decoding of requests sent to Server Function endpoints. Public advisories intentionally withheld a complete exploit recipe; do not infer undocumented mechanics.^{[1], [2]}

Step 3

Successful exploitation runs code as the web-server process

The advisory says code runs with the affected server process privileges. Impact depends on that process account and its reachable secrets and services.^{[1], [4]}

Step 4

Google GTIG observed campaigns delivering tunnellers, downloaders, backdoors, and miners

GTIG observed actor campaigns deploying tunnellers, downloaders, backdoors, and miners. This confirms real exploitation, not that every vulnerable host was compromised.^{[5], [6]}

Source Code: Flaw vs. Secure Implementation

This exact upstream patch excerpt returns only an own module export; it does not reproduce the full decoder flaw or constitute a standalone fix. Upgrade the affected React Server Components or framework package.^{[2], [1]}

Source excerpt: packages/react-server-dom-parcel/src/client/ReactFlightClientConfigBundlerParcel.js — requireModule()

UNPATCHED FLAW

export function requireModule<T>(metadata: ClientReference<T>): T {
  const moduleExports = parcelRequire(metadata[ID /* module id */]);
  return moduleExports[metadata[NAME]];
}

HARDENED SECURE PATCH

export function requireModule<T>(metadata: ClientReference<T>): T {
  const moduleExports = parcelRequire(metadata[ID /* module id */]);
  if (hasOwnProperty.call(moduleExports, metadata[NAME])) {
    return moduleExports[metadata[NAME]];
  }
  return (undefined: any);
}

Engineering & System Hardening Checklist

✓Check lockfiles, images, and deployed bundles for vulnerable React Server Components.^{[1], [4]}
✓Upgrade to fixed React RSC versions 19.0.1, 19.1.2, or 19.2.1 or later; use vendor-patched framework releases. For later RSC advisories, check the matrix and upgrade the resolved react-server-dom-* packages to the latest applicable fixed line; framework releases may bundle these packages.^{[1], [4], [8], [9], [10]}
✓Rebuild and redeploy every affected server; WAF rules are temporary defense-in-depth.^[1]
✓Verify actual deployed versions, not only package.json ranges.^[1]
✓If exposed while unpatched, investigate process creation and outbound traffic; rotate secrets after remediation.^{[5], [6]}