# React2Shell Security Bulletin

By Steven Van · 2025-12-05

Next.js apps on versions 15.0.0 through 16.0.6 face remote code execution risk and need the CVE-2025-55182 patch or npx fix-react2shell-next now.

A critical vulnerability in React Server Components, tracked as CVE-2025-55182 and nicknamed React2Shell, had public exploits circulating as of December 4, 2025. It affects React 19 and, through it, [Vercel](<https://creatorstoolbox.com/tools/vercel>)'s Next.js in versions 15.0.0 through 16.0.6 (CVE-2025-66478), as well as Next.js 14 canary builds after 14.3.0-canary.76, which need to be downgraded to that build or upgraded. Under certain conditions the vulnerability can lead to remote code execution.

Vercel's [bulletin](<https://vercel.com/blog/resources-for-protecting-against-react2shell>) calls for immediate action:

- Run the fix-react2shell-next npm package to patch a Next.js project automatically, or upgrade manually to the patched release for your version, for example 15.3.x to 15.3.6, or 16.0.x to 16.0.10.

- Turn on **Standard Protection** for all deployments other than the production domain, and audit shareable links from preview or custom-environment deployments.

- If an application was online and unpatched as of December 4, 2025 at 1:00 PM PT, rotate its secrets, starting with the most critical ones.

- Vercel Agent can now review projects for the vulnerability and open pull requests to upgrade them, from the security actions dashboard.

Vercel has deployed WAF rules to block known exploit patterns, though it notes these cannot guarantee protection against every variant, and is paying $25,000 to $50,000 through a HackerOne program for reports of successful bypasses of its platform protections for this CVE. A December 11 update to the bulletin noted two further vulnerabilities found during follow-up research into React Server Components, CVE-2025-55184 (denial of service) and CVE-2025-55183 (source code disclosure), which are covered in a separate bulletin.

[![](<https://images.ctfassets.net/hjgychtc108g/44YxsiH0DzV5EstphbDoUl/d2d7c028412e1df6f7678d928d971e0b/react2shell-bulletin-og.png>)](<https://vercel.com/blog/resources-for-protecting-against-react2shell>)

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://vercel.com/blog/resources-for-protecting-against-react2shell>)

[Read React2Shell Security Bulletin on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-react2shell-security-bulletin>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-react2shell-security-bulletin