React2Shell: The Critical RCE Vulnerability Every Next.js Developer Must Address Now

You've built your Next.js application using the App Router, deployed it to production, and moved on to the next feature. Then December 4th happened. Public exploits dropped for React2Shell—a critical remote code execution vulnerability affecting React Server Components—and within hours, state-sponsored threat actors were actively targeting vulnerable applications. If your production Next.js app is running versions 15.0.0 through 16.0.6, you may already be compromised.

This isn't hyperbole. CVE-2025-55182 carries the maximum CVSS score of 10.0, requires no authentication, and can be triggered with a single HTTP request against default Next.js configurations. Security researchers report near-100% exploitation success rates, and cloud security vendors have observed cryptomining campaigns, credential harvesting, and persistent backdoors deployed through this vulnerability within days of public disclosure.

Let's walk through what's happening under the hood, how to determine if you're affected, and the immediate steps you need to take to secure your applications.

Understanding the Attack Surface

React Server Components introduced a communication protocol called "Flight" that handles serialization and deserialization between server and client. When your Next.js application processes form submissions or server function calls, it uses this protocol to decode incoming payloads. The vulnerability lies in how React's deserialization logic handles malformed payloads—specifically, how it traverses prototype chains when resolving references.