Inside Vercel’s $1M effort to harden its WAF against React2Shell

In the weeks after React2Shell was disclosed, Vercel’s firewall logged more than 6 million blocked exploit attempts against vulnerable Next.js deployments. At peak, 2.3 million of those attempts arrived within a single 24-hour period.

The blocking was handled by Seawall, the deep request inspection layer of the Vercel Web Application Firewall (WAF). Rather than wait for bypass techniques to show up in the wild, Vercel opened a public bug bounty program and paid out over $1 million to 116 researchers for 38 validated disclosures covering 20 unique bypass techniques. Every one of those techniques is now a permanent rule in the firewall.

The company is now disclosing a second defense layer that operates at the compute level, which it says gives it high confidence that the WAF prevented real-world exploitation of the vulnerability.

The target: a 10.0 RCE

React2Shell, tracked as CVE-2025-55182, carries a perfect severity score of 10.0. The exploit sends a crafted payload to a server running vulnerable React Server Components; the console.log('☠️') string in the proof of concept gets evaluated server-side. Replacing that string with other code allows an attacker to run programs, extract secrets, or make network calls.

Before public disclosure, Vercel coordinated with AWS, Google, Microsoft, Cloudflare, Netlify, Fastly, Deno, and other providers so mitigations were already in place when the vulnerability became public knowledge. The company also anticipated follow-on research: within days of disclosure, two additional vulnerabilities in React Server Components were identified by outside researchers, requiring further patches and WAF updates.

Buying the bypasses before they were sold

Vercel’s response was to turn would-be exploit hunters into paid collaborators. The bug bounty program on HackerOne offered $50,000 for every unique technique that bypassed the WAF protections. According to HackerOne co-founder Michiel Prins, it was one of the fastest public program launches in the platform’s history.

The results: 156 reports from 116 researchers, with 38 validated disclosures and $1 million paid out across the 20 unique bypass techniques. Vercel shared all findings with other platform providers so the fixes extended beyond its own customers.

Hardening Seawall

Seawall inspects request payloads rather than just headers, blocking malicious patterns before they reach the application. Each validated HackerOne report went through a repeatable pipeline: reproduce the bypass, convert it into a test case, update the rules, deploy globally, then wait for the next report. Vercel shipped 20 Seawall updates in the first 48 hours of the program, with average response time per finding dropping from two hours to thirty minutes as the process was refined.

Most reports arrived in the first 24 hours, followed by a smaller batch in the second day, and then a trickle of more sophisticated techniques. AI tools proved useful in triage: the submissions often rely on subtle nuances and highly specific exploitation conditions, and modern models were able to convert those details into reproducible test cases. Every validated report became a Go-based unit test that now runs in CI whenever Seawall changes.

The second layer: runtime mitigation

Beyond the WAF, Vercel deployed a runtime mitigation that operates inside the application itself, on the compute layer. It targets the core mechanism of React2Shell: JavaScript functions have a constructor property that can be used to eval code at runtime. The mitigation denies this code execution during React rendering, eliminating the attack vector directly rather than relying on pattern matching.

Deno’s team shipped the first runtime mitigation for this vulnerability; Vercel adapted the approach for Node.js, validated it at scale, and shared the implementation back to other providers. Dedicated logging fires whenever the mitigation triggers, with automatic alerts to the security team. That means if a WAF bypass ever succeeded in production, the runtime layer would catch it and Vercel would know immediately.

The mitigation currently covers 96% of traffic on Vercel. Based on the logging from this layer, the company states with high confidence that the WAF was highly effective against React2Shell exploitation.

Two sophisticated bypasses

Lachlan Davidson, the original discoverer of React2Shell, and his research partner Sylvie submitted two of the most notable WAF bypasses during the program. They illustrate both the difficulty of building a robust WAF and the creativity required to defeat one.

Recursive UTF encoding

A common bypass technique is replacing regular characters with Unicode representations in JSON, which most WAFs normalize. Davidson and Sylvie went further: they used an exploit gadget that forces the React flight protocol to repeatedly JSON-decode the same string. A WAF robust against N layers of Unicode encoding could be defeated by using the gadget N+1 times. Seawall now recursively decodes until the payload is fully normalized.

The bypass relied on subtle behaviors of JavaScript’s built-in ReadableStream class, where errored stream chunks can be constructed so they don’t terminate stream processing, and the stringification of the error message can be leveraged into a function call exploit gadget.

Constructor without the colon

The core RCE gadget of React2Shell accesses the constructor property of a function using the React flight protocol’s colon-based property access syntax, which is why the exploit contains the string :constructor. WAF protections detect malicious payloads by flagging that string.

Rather than finding an entirely different exploit chain—which no researcher has yet managed—Davidson found a way to go from :constructor to constructor by using property access and string manipulation gadgets specific to the webpack modules in context for RSC parsing. The WAF can now detect this approach by targeting strings further up the attack chain, but it demonstrates how far payload obfuscation can go beyond the original proof of concept.

Beyond the firewall: getting customers to patch

Defense in depth bought time, but the actual fix was patching. Vercel shipped a security bulletin as the reference document, dashboard banners to flag vulnerable deployments, a CLI tool (npx fix-react2shell-next) for patching apps, and automated PRs via Vercel Agent.

The company frames this as a repeatable playbook: battle-hardened WAF rules, a runtime defense layer adaptable to future vulnerabilities, and cross-industry coordination that set a template for responding to critical CVEs. But the platform-level protections are explicitly a stopgap, not a substitute for upgrading. The message is unchanged: if you are running a vulnerable version of Next.js, patch now, because the next critical vulnerability will eventually arrive.