The React2Shell Story

A researcher disclosed a critical React remote code execution flaw, dubbed React2Shell, affecting React-based stacks such as Next.js.

Meta shipped a fix by December 3 and issued an advisory urging developers to update immediately.

The issue, tracked as CVE-2025-55182, involved React Server Components, Server Actions, and the Flight protocol.

Because the bug could expose millions of sites to code execution, rapid patching was essential.