What Is React2Shell (CVE-2025-55182)? Explained for Bug Hunters
React2Shell is the popular name for CVE-2025-55182, a critical remote code execution issue in the React Server Components / Flight path. People compared it to Log4Shell because it was pre-auth, easy to weaponize once a PoC existed, and tied to a widely used stack — not one company’s custom code.
This piece is a calm briefing: what broke, why it mattered, and how to respond as a hunter or defender.
Quick takeaway: Treat framework RCEs as inventory + patch problems first. Confirm versions, reduce exposure, then report responsibly — do not mass-scan the internet with public exploits.
The simple model
The server accepted structured RSC/Flight input and deserialized it too trustingly.
Attackers could abuse object references and prototype pollution style chains until the process reached powerful JavaScript constructors — often without a normal login.
You do not need every gadget memorized to be useful. You need:
- Version awareness
- Exposure awareness
- A safe proof strategy that matches the program’s rules
Why “Log4Shell vibes” showed up
Shared traits:
- Pre-authentication RCE
- Low complexity after a working PoC
- Fast scanning once payloads leaked
Difference that matters: React Server Components are common, but not as universal as Log4j. Still, if your org runs a vulnerable Next.js / RSC app on the internet, urgency is “patch now.”
What hunters should check
When a framework RCE drops:
- Search lockfiles for React / Next / RSC-related packages
- Note which apps are internet-facing
- Ask whether WAF rules cover the relevant protocol/headers
- Prefer vendor advisories over random GitHub PoCs
If a bounty program lists the stack, report with:
- Affected package versions
- Advisory links
- Safe reproduction notes the program allows
Defender playbook (short)
- Patch to fixed releases
- Rotate secrets if compromise is plausible
- Hunt for weird process trees and suspicious RSC traffic
- Review egress: miners and reverse shells need outbound access
What this teaches for the next CVE
New protocols (Flight, custom RPC, fancy batch APIs) deserve the same hostility as classic unserialize().
If a special header alone can enter a dangerous decoder, “we don’t use that feature” may be false comfort.
Original Bugflare article. Technical understanding informed by public research such as Wiz’s CVE-2025-55182 analysis. Always verify current patched versions from official advisories.