CVE-2025-55182

lastmod 2025-12-07created 2025-12-071 edits

CVE-2025-55182 (React2Shell), a remote code execution vulnerability in React and Next.js

About

• A remote code execution (RCE) vulnerability that allows arbitrary code execution without authentication was found in React Server Components; immediate upgrade required
• Next.js is also affected and is vulnerable when the App Router feature is used. Next.js tracks this as CVE-2025-66478
• The root cause of the vulnerability is server-side prototype pollution; an attacker can manipulate the prototype of JavaScript objects to execute commands via child_process.execSync and the like
• Public PoC (proof of concept) code spread quickly, and as of December 5, Datadog detected actual attack attempts from more than 800 IPs
• Rated a CVSS score of 10, this vulnerability is especially severe in Next.js 15.x–16.x, and applying the latest patches is essential

See also

• React
• Next.js

Favorite site

• CVE-2025-55182 (, a remote code execution vulnerability in React and Next.js | GeekNews
  • [Original] CVE-2025-55182 (React2Shell): Remote code execution in React Server Components and Next.js | Datadog Security Labs