Urgent upgrade your React and Next JS packages immediately
This video covers a critical security vulnerability affecting modern React and Next.js apps: React2Shell (CVE-2025-55182), a CVSS 10.0 remote code execution bug in React Server Components. If you are using React 19 with RSC or the Next.js App Router on vulnerable 15.x/16.0.x versions, attackers can potentially run arbitrary commands on your server with no authentication, leading to data theft, crypto mining, or full server takeover.
Inside the video, you’ll learn:
What CVE-2025-55182 (React2Shell) is and how it abuses the React Flight protocol used by React Server Components and Next.js App Router.
How real attackers craft malicious Flight payloads and send them to RSC endpoints to execute system commands like whoami, read environment variables, install miners, or open reverse shells.
Exactly which versions are vulnerable and which ones to upgrade to:
react-server-dom- vulnerable in 19.0, 19.1.0, 19.1.1, 19.2.0 and patched in 19.0.1, 19.1.2, 19.2.1.
Next.js 15.x/16.0.x vulnerable series and the required patched releases such as 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, plus guidance for canary builds.
If you run anything on React 19 or Next.js 15/16, watch this before attackers find your server. Update your dependencies, verify your versions, and share this video with your team so they don’t ship or keep running vulnerable builds in production.