Explore all React2Shell and framework vulnerability guides →
Changing package.json is the beginning of a React or Next.js security fix. To close the issue, connect the vendor's remediation instructions to the dependency versions in your build, then connect that build to every deployment that still accepts requests. A successful local build or a merged pull request does not prove production is running the patch.
Use the current advisory for your release line
React2Shell is a useful example of why advisory-specific verification matters. The Next.js advisory for the December 2025 React Server Components RCE describes affected App Router deployments and requires an upgrade to patched software. Its original fixed-version list concerns that advisory; do not treat an old minimum version as a guarantee against later vulnerabilities. Review the current vendor security notices before choosing a supported release.
Check the installed dependency tree, not just a version range
- Identify the application workspace used by the production build. Monorepos can contain several framework versions and deployable services.
- Compare the manifest with the lockfile and resolved dependencies in the actual build environment. Record direct and relevant transitive packages.
- Review framework-specific instructions for bundled dependencies. Updating a top-level React package is not evidence that every framework-bundled component changed.
- Build from the intended commit using the checked-in lockfile, and record the build identifier or container digest with the dependency evidence.
Follow the artifact into production
Use deployment records to show which artifact is active behind the customer-facing hostname. Check each region or replica if your platform allows mixed versions during a rollout. Include worker services or separate applications when they use the affected component. Keep a rollback option that does not reintroduce the known vulnerable artifact.
- Record the approved source commit, resolved package versions and completed build.
- Confirm deployment completion in the hosting platform and map the live service to that artifact.
- Check remaining public preview links, legacy hostnames and old deployments; patch them or remove unnecessary access.
- Test ordinary application journeys such as sign-in, server-rendered pages and relevant server actions after deployment.
- Save the evidence and assessment date in the remediation ticket so another engineer can verify the conclusion.
Keep patch verification separate from incident investigation
A patched deployment can still require investigation if the earlier version was exposed. Next.js's React2Shell guidance also recommends rotating application secrets after patching and redeploying. Follow the applicable advisory and your incident process to assess the exposure window, relevant logs and credentials. Removing the entry point does not by itself establish whether it was used before the fix.
Use a website scan as additional release evidence
After deployment, run MyPentest on your authorized site to review supported website security checks and compare any relevant findings with the earlier report. Inspect unchecked coverage as carefully as completed results. The scan can support your wider release review, but an empty findings list does not independently verify a React2Shell patch or rule out every React and Next.js CVE.
Close a patch ticket with the advisory, affected-service decision, resolved version, live artifact ID and verification date. If a deployment cannot be inspected, keep that part of the status unresolved.