Automated React2Shell vulnerability patching is now available
By Steven Van ·
The free auto-fix targets React2Shell (CVE-2025-55182), a critical RCE bug hitting React 19 and Next.js projects.
Vercel Agent can now find and fix a critical vulnerability on its own. When it detects a project running a vulnerable version of React, Next.js, or a related React Server Components package, it opens a pull request with the upgrade to a patched version, at no cost.
- Automatic detection of vulnerable React, Next.js, and related RSC packages
- Automatic PR creation
- Full execution and verification of updates inside isolated Sandbox environments
- Preview links generated with the PR, so the update can be validated manually before merging
The fix targets React2Shell (CVE-2025-55182), a critical remote code execution vulnerability in React Server Components that affects React 19 and frameworks built on it, including Next.js. A specially crafted request can trigger unintended code execution on a vulnerable version, and Vercel says immediate upgrades are required for all affected React and Next.js releases.