Notifications
Clear all
Topic starter
02/08/2026 9:41 am
TL;DR: React2Shell, a critical CVE-2025-55182 in React Server Components, allows unauthenticated remote code execution through unsafe deserialization in the Flight protocol, with active exploitation observed within hours of disclosure according to StackHawk. The episode reinforces that dependency awareness is not the same as exploitability, and runtime validation now matters as much as patching.
NHIMG editorial — based on content published by StackHawk: React2Shell and the critical React RCE vulnerability
By the numbers:
- React2Shell was categorized as Critical with a CVSS score of 10.
- All current versions of React Server Components, including React 19.2.0, are vulnerable.
Questions worth separating out
Q: What breaks when React Server Components are exposed to crafted Flight payloads?
A: The server can deserialize attacker-controlled data as if it were legitimate framework state, which can redirect execution flow and trigger remote code execution.
Q: Why do framework RCE flaws quickly become identity risks?
A: Because once an attacker can execute code on an application server, the fastest route to persistence is often through secrets, tokens, and service account credentials.
Q: How do security teams know whether a vulnerable React package is actually exploitable?
A: They need runtime validation, not just dependency inventory.
Practitioner guidance
- Patch exposed React and Next.js instances immediately Upgrade React Server Components and Next.js App Router deployments to the fixed versions listed in the security advisory, then verify all production and pre-production environments are on the same baseline.
- Map every reachable Flight endpoint Inventory applications that support React Server Components, identify which endpoints accept Flight payloads, and confirm whether they are internet-facing or exposed through shared ingress paths.
- Validate exploitability with runtime testing Run active checks against deployed applications to confirm whether the vulnerable path is reachable, then retest after patching to ensure the exploit no longer succeeds.
What's in the full article
StackHawk's full post covers the operational detail this post intentionally leaves for the source:
- Exact patch guidance for React and Next.js version families affected by CVE-2025-55182
- Command-line checks for identifying vulnerable react-server-dom-* dependencies in npm and yarn projects
- Network and host indicators that help confirm whether exploitation attempts already occurred
- StackHawk plugin details for runtime validation of exploitability after remediation
👉 Read StackHawk's analysis of the React2Shell critical RCE vulnerability →
React2Shell and server components: are your controls keeping up?
Explore further
02/08/2026 12:35 pm
React2Shell is a reminder that framework trust boundaries are identity-adjacent attack surfaces. Once server-side code execution is possible, the next question is rarely just application integrity. Attackers commonly move toward secrets, tokens, and service credentials because those assets unlock persistence and lateral movement. For IAM and NHI teams, that means a framework flaw can become a control failure for secrets governance and service account containment. The practitioner conclusion is simple: runtime application risk now belongs in identity risk discussions.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: What should teams do when a public RCE in a framework is already being exploited?
A: Treat the issue as a potential incident, not a simple patch task. Patch affected systems, isolate exposed applications where needed, review authentication and secret exposure around those workloads, and search for compromise indicators before declaring recovery. If internet-facing systems were vulnerable, assume the attacker may already have attempted or achieved execution.
👉 Read our full editorial: React2Shell shows how deserialization flaws become instant RCE
