The landscape of modern web development shifted significantly with the introduction of React Server Components (RSC), a paradigm designed to optimize performance by offloading rendering tasks to the server. However, as with many architectural shifts, the introduction of new protocols brings unforeseen security challenges. In late 2025, the discovery of CVE-2025-55182, colloquially known as "React2Shell," sent shockwaves through the cybersecurity community. This vulnerability, which carries a maximum CVSS score of 10.0, exposed a critical flaw in the Flight protocol—the streaming mechanism that powers React Server Components. By manipulating the way the Flight protocol deserializes data, unauthenticated attackers were able to achieve remote code execution (RCE) on vulnerable servers, leading to widespread exploitation and a coordinated response from federal agencies and security researchers.
The Architecture of the Flight Protocol
To understand the React2Shell vulnerability, one must first understand the Flight protocol. Unlike traditional web frameworks that transmit HTML or standardized JSON, React Server Components utilize a custom, line-delimited streaming format. When a server component renders, the React runtime generates a Flight payload—a mix of JSON fragments, metadata, and executable references—which is then streamed to the client-side React runtime for reconstruction.
The Flight protocol is designed to be efficient, allowing the browser to begin rendering parts of the UI before the entire response has arrived. It uses a specific row format: <ROW_ID>:<ROW_TAG><PAYLOAD>. Various tags define the nature of the data: ‘J’ for JSON trees representing virtual DOM nodes, ‘M’ for module metadata, ‘I’ for import directives, and ‘F’ for server references. This system allows React to maintain complex state and behavior across the network boundary.
The vulnerability resides within the protocol’s prefix system, specifically the $ prefix used for reference resolution. When the React parser encounters a string starting with $, it triggers a specialized resolution path. For instance, $1 might point to a previously loaded data chunk, while $: triggers property access. This system, while powerful, effectively creates a complex deserialization engine that operates on untrusted network input.
Chronology of the React2Shell Crisis
The timeline of the React2Shell vulnerability highlights the speed at which modern web vulnerabilities move from discovery to state-sponsored exploitation.
- December 3, 2025: The React team officially discloses CVE-2025-55182, following a private report by security researcher Durgesh Pawar. The vulnerability is identified as a flaw in the
getOutlinedModelfunction within the Flight deserialization layer. - December 5, 2025: Security firms observe the first proof-of-concept (PoC) exploits appearing in underground forums. The ease of exploitation—requiring only a single crafted HTTP request—leads to an immediate surge in scanning activity.
- December 8, 2025: The Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2025-55182 to its Known Exploited Vulnerabilities (KEV) catalog, ordering federal agencies to patch within 24 hours.
- December 10, 2025: Sysdig releases a report linking active exploitation to "Lazarus Group," a North Korean state-sponsored threat actor. The attackers are observed deploying "EtherRAT," a file-less malware implant that utilizes the Ethereum blockchain for command-and-control (C2) communication.
- January 2026: A secondary wave of vulnerabilities is discovered as researchers audit the Flight protocol more closely. This leads to the disclosure of CVE-2025-55184 and CVE-2026-23864, which focus on Denial of Service (DoS) and memory exhaustion vectors.
Technical Breakdown: From Deserialization to RCE
The core of the React2Shell vulnerability lies in a lack of input sanitization during property traversal. When the Flight parser processes the $: prefix, it attempts to resolve a path within a data object. The vulnerable implementation of getOutlinedModel utilized a loop that accessed properties directly based on colon-separated segments in the payload.
The critical oversight was the absence of a hasOwnProperty check. In JavaScript, objects inherit properties from their prototypes. By supplying a path such as $1:__proto__:constructor:constructor, an attacker could force the parser to walk up the prototype chain. This traversal leads from a standard object to the Object prototype, then to the Object constructor, and finally to the Function constructor.
In JavaScript, the Function constructor acts similarly to eval(), allowing the creation of a new function from a string. By chaining this with other Flight features—such as the $@ prefix, which exposes internal framework "Thenables"—attackers could trigger the execution of arbitrary code during the normal asynchronous resolution process of the React runtime. This "gadget chain" transformed a simple parsing error into a full system compromise.
Supporting Data: The Impact of Deserialization Vulnerabilities
The severity of React2Shell is reflected in the technical data surrounding its disclosure. The vulnerability affected all applications using React Server Components in versions 19.0.0 through 19.2.0.
| CVE Identifier | CVSS Score | Primary Risk | Patch Version |
|---|---|---|---|
| CVE-2025-55182 | 10.0 | Remote Code Execution | 19.0.1 / 19.1.2 / 19.2.1 |
| CVE-2025-55184 | 7.5 | Denial of Service (Recursion) | 19.0.2 / 19.1.3 / 19.2.2 |
| CVE-2026-23864 | 7.5 | Memory Exhaustion (OOM) | 19.0.4 / 19.1.5 / 19.2.4 |
| CVE-2025-55183 | 5.3 | Source Code Disclosure | 19.0.1 / 19.1.2 / 19.2.1 |
Beyond the RCE, CVE-2025-55183 demonstrated that the Flight protocol could be used to leak sensitive server-side information. By sending crafted arguments to a Server Function, attackers could trigger an error state that reflected the function’s own source code in the response. This highlighted a fundamental risk in "server-driven UI" patterns: when the boundary between server and client becomes transparent, any leak in that transparency can expose intellectual property or credentials.
Official Responses and Remediation Efforts
The React team’s response to the crisis was characterized by a focus on hardening the internal plumbing of the framework. The primary fix involved shadowing the Object.prototype.hasOwnProperty method at the module level. By using hasOwnProperty.call(value, key) instead of direct property access, the team ensured that the parser would only interact with properties explicitly defined on the data object, effectively blocking prototype pollution.
However, many security experts argued that the patch was a reactive measure rather than a structural fix. Industry analysts noted that the Flight protocol still relies on reconstructing complex behavior from raw text streams. In a statement regarding the vulnerability, Palo Alto Networks’ Unit 42 emphasized that "the architectural decision to allow arbitrary property traversal over a network protocol creates a permanent attack surface that requires constant vigilance."
Vercel, the primary maintainer of Next.js, also issued updates to address a related CSRF bypass (CVE-2026-27978). This bug occurred because the framework failed to properly handle the Origin: null header sent by sandboxed iframes, allowing attackers to perform cross-site actions against authenticated users.
Broader Impact and Industry Implications
The React2Shell vulnerability serves as a modern reminder of the dangers inherent in custom serialization formats. Historically, frameworks like Java (via ObjectInputStream) and .NET (via BinaryFormatter) have struggled with similar patterns where the act of reconstructing data inadvertently triggers executable behavior.
The implications for the industry are twofold. First, there is a renewed push for "Defense in Depth" at the application layer. Developers are increasingly urged to adopt strict schema validation using libraries like Zod or Valibot at the entry point of every Server Action. Validating the shape and type of data before it interacts with the framework’s internals is now considered a mandatory security practice for RSC applications.
Second, the event has sparked a debate regarding the security of "Zero-Bundle-Size" architectures. While moving logic to the server reduces the amount of JavaScript sent to the client, it increases the complexity of the network protocol required to synchronize the two environments. As more frameworks adopt server-driven UI patterns, the industry may need to move toward cryptographic signing of serialized payloads to ensure that the Flight stream has not been tampered with in transit.
Future Outlook: Structural Risks and Remaining Exposure
Despite the patches, several structural risks remain inherent to the React Server Components model. Security researchers continue to investigate "Man-in-the-Middle" (MITM) attacks on the Flight stream. Because the format is plain text, an attacker with control over a proxy or CDN could potentially inject malicious module imports ($I) or modify component props to achieve Cross-Site Scripting (XSS).
Furthermore, the exposure of Server Action IDs remains a concern. These IDs, while obfuscated, are often mapped in publicly accessible manifests. If an attacker can enumerate these IDs, they can bypass the intended UI flow and interact with server-side logic directly, leading to Insecure Direct Object Reference (IDOR) vulnerabilities.
As the ecosystem matures, the React community must shift from a "trust the server" mindset to a "verify the stream" approach. The React2Shell vulnerability was not an anomaly; it was a predictable outcome of increasing protocol complexity. For organizations deploying these technologies, the lesson is clear: framework-level security is a baseline, but application-level rigor—through validation, encryption, and strict boundary management—is the only way to secure the modern web.
