Explore all React2Shell and framework vulnerability guides →
React2Shell is the name commonly used for CVE-2025-55182. React disclosed this critical, unauthenticated remote code execution vulnerability on December 3, 2025. It concerns React Server Components (RSC), rather than every website displaying a React interface. Start with the software running on your server, then establish whether its deployed configuration falls within the advisory.
Which React applications were affected?
React's advisory identifies versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0 of react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack. An application supporting RSC can be affected even without deliberately implementing Server Function endpoints. Client-only React applications without a server or RSC integration are outside this advisory's scope.
Check the deployed application, not just package.json
- List production domains, preview deployments and older environments that remain reachable. Assign an owner to each application.
- Inspect the resolved dependency tree and lockfile for the deployed build. A declared version range alone does not identify the installed package.
- Record the framework, RSC packages, deployment identifier and runtime. If your hosting provider bundles dependencies, inspect its build output or ask for the resolved versions.
- Compare that evidence with the official advisory and the framework's current security release guidance. Keep the evidence alongside the remediation ticket.
A public page may hide framework details, and a response header may be cached or misleading. Neither an absent framework fingerprint nor a successful homepage request demonstrates that the server is patched. Where version evidence is unavailable, record the status as unknown until the application owner can verify it.
Patch, redeploy and verify the release
The initial RCE fixes were 19.0.1, 19.1.2 and 19.2.1. Later RSC advisories require additional updates, so those historical minimums are not a complete patch target today. React also cautions against relying solely on hosting-provider mitigations.
Use a supported framework release that includes applicable security fixes. Rebuild and deploy the application, then verify which release serves production traffic. Updating a local lockfile leaves the running server unchanged until the deployment completes. Test sign-in, server-rendered pages and critical user journeys after the change. If compromise is suspected, preserve evidence and follow your incident-response process; a software update does not establish what happened before it.
Can a website scan tell me whether React2Shell is present?
A scan is useful only within its documented coverage. Ask whether it checks an exact dependency version, observes a public signal, or performs a dedicated validated check. Those evidence types answer different questions. A scan that finds no supported issues cannot certify an entire application free of this CVE.
Run a MyPentest scan on a site you own or are authorized to test to review supported website security checks. React2Shell-specific detection is not confirmed here. Use the official advisory and deployed dependency evidence to establish CVE-2025-55182 exposure; treat any untested condition as unknown.