React2Shell unsafe deserialization in React Server Components leads to RCE

React2Shell is the name given to CVE-2025-55182, disclosed by Meta and Vercel on December 3, 2025 (reported to the React team by researcher Lachlan Davidson on November 29, 2025) and added to CISA's Known Exploited Vulnerabilities catalog two days later. It's an unsafe deserialization bug in how React Server Components decode the "Flight" wire format used by Server Function requests. A crafted POST request carrying a `Next-Action` header - the marker any RSC-supporting framework uses to route a request to a Server Function - can be deserialized unsafely by the affected `react-server-dom-webpack`/`-turbopack`/`-parcel` packages, leading to unauthenticated remote code execution. The advisory is explicit that an app doesn't need to define its own Server Action to be exposed - just shipping on an affected build with RSC support is enough, which is what made this bug so widely reachable across the Next.js ecosystem.

This lab installs Next.js 15.4.7 (the last 15.4.x build before the fix in 15.4.8), which bundles React 19.1.0 - one of the four versions the advisory names as affected. The app defines one small Server Action behind a form, making the attack surface explicit for practice, the same way this repo's log4shell lab logs a header through a vulnerable log4j build rather than leaving the vector implicit. A flag is dropped at the filesystem root; winning the lab means getting a shell and reading it.

Remote code execution bugs are the ones defenders care about most. This target is useful for testing detection rules and logging.

Product

React

Version

19.1.0

Type

RCE

Severity

Critical

This playbook needs the setup from the earlier steps. Check these first.

• The base VM from Step 01 is built and reachable over SSH.
• You cloned the playbooks repo and set inventory/hosts.ini in Step 02.
• A snapshot named clean-base exists, and the machine is booted from it.

One CVE at a time. Don't run this on top of another playbook. Reset first.

Boot the machine from clean-base, then run the playbook for CVE-2025-55182. It installs React 19.1.0, sets up its config and starts the service.

ansible-playbook cve/cve-2025-55182.yml 

A clean run ends with a recap that shows failed=0. If it fails partway, run it again.

The verify tag checks that the service is listening and running the version this CVE affects. Run it from the host.

ansible-playbook cve/cve-2025-55182.yml  --tags verify

You should see target OK.

- POST requests to application routes carrying a `Next-Action` header, especially from clients that never loaded the page first (no matching prior `GET`, no referer, no session) - a sign of a crafted request hitting the Server Function endpoint directly rather than a real form submission. - Unexpected child processes spawned by the Node.js process running `next start`, with no corresponding application log entry explaining why. - The exact Next.js/React version in use (via `npm ls`, lockfile inspection, or a software composition analysis tool) falling in the affected ranges: Next.js from `14.3.0-canary.77` up to the first patched release on each line, or react/`react-server-dom-*` at `19.0.0`, `19.1.0`, `19.1.1`, or `19.2.0`. - Outbound connections or file-system/process activity from a Node.js web server process that has no legitimate reason to shell out.

React shipped fixed `react-server-dom-webpack`, `react-server-dom-turbopack`, and `react-server-dom-parcel` releases at 19.0.1, 19.1.2, and 19.2.1, which patch the Flight deserialization path. Next.js shipped matching patched releases across its supported lines (15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, and later canaries). Two follow-on issues were found in the same code path shortly after - CVE-2025-55183 (source code exposure) and CVE-2025-55184 (denial of service) - fixed in the next round of releases (19.0.2, 19.1.3, 19.2.2). A separate, later denial-of-service issue, CVE-2026-23864, affects 19.0.0 through 19.2.3 and is fixed in 19.0.4, 19.1.5, and 19.2.4. Current guidance is to move to the latest patched release on your line rather than stopping at the first fix.

Restore clean-base. Nothing from this playbook carries over.

VBoxManage controlvm thehackingmachine acpipowerbutton
VBoxManage snapshot thehackingmachine restore clean-base
VBoxManage startvm thehackingmachine

• https://nvd.nist.gov/vuln/detail/cve-2025-55182
• https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
• https://vercel.com/changelog/summary-of-CVE-2025-55182
• https://www.offsec.com/blog/cve-2025-55182/

Playbook and write-up by TheHackingMachine Team.

Want to add your own? See how to contribute.