React2Shell Security Bulletin

React Server Components Flaw Triggers Urgent Patches

On December 4, 2025, public exploit code appeared for React2Shell, a critical remote code execution vulnerability in React Server Components (CVE-2025-55182) that also affects Next.js (CVE-2025-66478). A follow-up disclosure on December 11 detailed two additional React Server Components issues—CVE-2025-55184 (denial of service) and CVE-2025-55183 (source code disclosure)—both of which require patching. This is a fast-moving situation; monitoring Vercel's dashboard and security bulletins is advisable.

Who Needs to Act

Any application running Next.js 15.0.0 through 16.0.6 is vulnerable and should be upgraded immediately, regardless of other security measures. Next.js 14 canary builds after 14.3.0-canary.76 are also affected and need to be downgraded or upgraded. More broadly, any framework implementing React Server Components with React 19 is at risk—update React and its server component packages right away.

To determine if you're exposed, check the versions of these packages:

• next
• react-server-dom-webpack
• react-server-dom-parcel
• react-server-dom-turbopack

Vercel users will see a banner in the dashboard when a production deployment runs a vulnerable version. The npx fix-react2shell-next utility can also automate version detection (see below).

Patched Releases for Next.js

Upgrading to a patched Next.js release is the only complete fix. The patched versions include a hardened React Server Components implementation. If you rely on canary releases for Partial Prerendering (PPR), update to 15.6.0-canary.58, which resolves the vulnerability while retaining PPR support. For other patch options for older versions, consult the Next.js discussion post referenced in the official advisory.

Upgrade Path for Next.js Applications

Automated Upgrade via Vercel Agent

Vercel Agent can identify vulnerable projects and automatically open pull requests that upgrade dependencies to patched versions. Vulnerable projects and upgrade initiation are surfaced in the Vercel security actions dashboard.

Command Line Utility

Run the following command from the root of your Next.js project to update to a safe version:

npx fix-react2shell-next

Manual Upgrade Steps

1. Identify your current version. Check package.json or run next.version in the browser console on any page of your app.

{
  "dependencies": {
    "next": "15.3.4"
  }
}

2. Determine the patched release you need based on the current version:

3. Update package.json to the appropriate patched version:

{
  "dependencies": {
    "next": "15.3.6"
  }
}

4. Install dependencies and update the lockfile. Always commit lockfile changes together with package.json changes, then run your package manager's install command:

# npm
npm install
# yarn
yarn install
# pnpm
pnpm install
# bun
bun install

5. Deploy immediately after testing. When deploying with the Vercel CLI:

vercel --prod

Note that Vercel itself now blocks new deployments of vulnerable versions, and its WAF rules filter known exploit patterns—but these measures do not replace patching.

Protecting Deployments and Secrets

Deployment Protection

Even after patching production, older versions may remain exposed. Enable Standard Protection for all deployments outside your production domain. Audit shareable links and any deployment protection exceptions; if you've disabled protection to share preview or custom environment domains, ensure those deployments are patched first.

Rotate Environment Variables

Assume vulnerable systems may be compromised. After patching and redeploying, rotate all application secrets and environment variables for your Vercel team and projects.

Upgrading Other Frameworks

If you use a framework other than Next.js that implements React Server Components, consult the React Security Advisory on the react.dev blog for patched version details and upgrade instructions.

Upgrade Path and Detection

To simplify the process of identifying and patching affected installations, we have released an npm package that scans projects for vulnerable packages and upgrades them. The full usage documentation is available on the package page. Below is an example of how to run the package:

The most reliable way to determine if you are exposed to this vulnerability is to verify the version of React or Next.js you have deployed against the CVE database. Our vercel.com dashboard now includes a banner for affected customers that flags production deployments running a vulnerable next, react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack version. That banner is a supplementary safeguard, not a replacement for direct checks.

If you need to confirm whether your application was actually exploited, there is no definitive method. Review your logs for anomalies such as unexpected POST requests or higher function timeout rates. Timeouts should not by themselves suggest exploitation, since attackers can craft payloads that execute without hanging, and timeout spikes frequently come from scanning attempts rather than successful attacks. Note that Vercel deployed WAF mitigations before the CVE was announced, and we have since fixed bypasses to those rules when new exploit variants appeared.

Available Mitigations

Upgrading to a patched release is the only complete fix. WAF rules add defense in depth by filtering known payloads, but they are not a guarantee against every variant. By applying the rules above or your normal patch procedure you can actively remedy the issue. Also double-check your deployment protection settings to confirm that all environments, including non-production domains, are adequately protected.

As of this morning, December 5, we have published additional WAF rules to stop newly observed exploit patterns, and we continue to iterate. For applications using canary-only Next.js features, please upgrade to a patched build instead of waiting. The Next.js Security Advisory details the procedure for moving to a fixed version while preserving those canary-only capabilities.

Testing Best Practices

Avoid running public proof-of-concept exploits against production systems. A preferable approach is to confirm all public deployments are on current React Server Components and Next.js releases. If you need deeper verification, test inside a sandboxed setup with synthetic data so you avoid unintentional damage to production services.

v0 applications are currently being auto-patched over the coming days. Until that finishes, apply the fix manually to any affected v0 app:

1. From the fallback deploy dialog, choose the chat linked to your affected project
2. Fire the "Fix with v0" button to trigger a patched redeploy

v0 projects that have never been published are not exposed to Reac2Shell.