React2Shell: critical flaw in React and Next.js, update and rotate secrets

In December 2025, the React team disclosed a critical flaw in React Server Components, nicknamed React2Shell (CVE-2025-55182, rated 10 out of 10). A single crafted web request, sent without any login, could let an attacker run their own code on the server behind a site. Next.js, the most popular framework built on React, was affected through its App Router. Next.js first tracked it as CVE-2025-66478, a record later rejected in favour of the React one.

Attacks followed quickly. The US cybersecurity agency CISA added the flaw to its catalogue of vulnerabilities exploited in the wild on December 5, 2025, and marks it as used in ransomware campaigns. On December 11, 2025, and again on January 26, 2026, React published further fixes for denial of service (freezing or crashing the server) and source code exposure, found while researchers studied the first patch. Some of the first fixes were incomplete, so an early update was not enough.

Who is affected

Sites and web apps built with Next.js 15 or 16 using the App Router, or Next.js 14.3 canary versions from 14.3.0-canary.77. Also other frameworks that support React Server Components, such as React Router, Waku and RedwoodSDK. Next.js sites using only the Pages Router were not affected. A React site with no server, or a WordPress site, is not concerned.

How to check your site

If you are not sure what your site is built with, ask your developer, or look in the project's package.json file for "next" or "react-server-dom". Hosting dashboards such as Vercel or Netlify usually show the framework too. Then check the version of next listed in package.json or package-lock.json.

What to do now

• Ask your developer to update. The fixed React Server Components packages are 19.0.4, 19.1.5 and 19.2.4 or later. For Next.js, React lists patched versions such as 14.2.35, 15.5.10 and 16.1.5 for those lines. Next.js published further critical fixes in 2026, and in October 2026 the current security releases are 15.5.28 and 16.4.1 (see our separate alert).
• If your app was online and unpatched on December 4, 2025, Next.js recommends rotating every secret it uses (API keys, database passwords, payment keys), starting with the most critical.
• Ask your developer or host to look for signs of intrusion on exposed servers, as CISA recommends.
• Sites updated since early 2026 are most likely protected, but check the version.

This alert reports what the sources published and is not a guarantee about any specific site.