React2Shell: The Critical Web Vulnerability Affecting Millions of Sites (December 2025 Update)

A new security flaw—nicknamed React2Shell—has become one of the most serious web vulnerabilities of the past few years. It affects React Server Components and Next.js, two of the most widely used technologies powering modern websites, SaaS platforms, customer portals, CRMs, and internal dashboards.

If your company uses React or Next.js, this update matters to you.

Why This Vulnerability Matters

Huge ecosystem impact:

• React used by 20M+ developers

• 3M+ production websites running Next.js

• ~45% of SaaS companies rely on these technologies

This makes the attack surface extremely large.

Unauthenticated Remote Code Execution (RCE):

Attackers can run commands on a server without logging in.

Active exploitation:

Millions of scans detected in early December; confirmed intrusions across multiple sectors.

What Actually Happened?

The flaw is in React Server Components (RSC). A weakness in how RSC processes data allows attackers to send a crafted request and trick the server into executing code. This impacts SaaS products, dashboards, internal tools, APIs, and customer-facing web apps.

Who Is Affected?

React (CVE-2025-55182): Any app running vulnerable React 19 RSC packages.

Next.js (CVE-2025-66478): Apps using the App Router on older versions.

Commercial Impact

• Exposure of customer data

• Business downtime and suspended services

• Reputational damage

• Possible regulatory issues (GDPR, NIS2, PCI, contracts)

Key Statistics

• 20M+ React developers

• 3M+ Next.js sites

• 45% of SaaS relies on React frameworks

• CVSS score 10/10

• Millions of exploit attempts within one week

• Confirmed compromises in multiple countries

What Companies Should Do

1. Verify whether the product uses React Server Components or Next.js App Router.

2. Apply the official patch immediately and redeploy.

3. Review access logs for unusual activity.

4. Rotate sensitive credentials.

5. Brief internal teams.

---

Need help assessing your exposure or responding to this vulnerability? Contact Cybool's security team for immediate assistance.