Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2025-55182: What you need to know about React2Shell

bugcrowd.com | vulnerability | Critical | Actively exploited | CVE-2025-55182 | #rce

Summary

On December 3, 2025, the React Team disclosed a critical remote code execution (RCE) vulnerability affecting React Server Components, commonly used in modern Next.js deployments. An unauthenticated attacker could craft a malicious HTTP request that, when deserialized by React, results in remote code execution on the server. Additional technical details will be released once the […]
CVSS
10
Published
Collected

original ↗

Related coverage

  1. React2Shell (CVE-2025-55182): A Wake-Up Call for Modern Web Security and How XBOW Helps You Respond (xbow.com)
  2. CVE-2025-55182: Unauthenticated React Exploit Affects Millions of Sites (hackerone.com)
  3. Protecting Against Zero-Day Vulnerabilities with SOC-Level ASM Alert (wiz.io)
  4. React2Shell (CVE-2025-55182): Node.js RCE Against a Production Next.js App (hunt.io)
  5. React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability (wiz.io)
  6. React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182 (wiz.io)

back