4 min read ·
React2Shell CVE-2025-55182: how to check your website's exposure
Understand React2Shell exposure, inspect deployed React Server Components dependencies, and combine patch verification with a scoped website security scan.
Website vulnerability library
Is your website affected? Start with the evidence.
React2Shell, framework CVEs and practical patch checks: find the right advisory, understand your deployment and decide what to test next.
From security headline to a deployment decision
- 01
Identify
Match the CVE and vendor advisory to the software and features you actually deploy.
- 02
Check
Inspect production versions and configuration. Use supported security checks to gather additional evidence.
- 03
Verify
Apply the vendor's fix, confirm the deployment and record the retest outcome and remaining gaps.
Find a vulnerability or response guide
Search by name, CVE or question. Try “React 2 Shell”, “Next.js”, “WAF” or “patch”. Minor spelling errors in words are supported; CVE numbers must match.
All guides are available below.
7 guides
Understand the advisory and affected software
Start with the product, CVE and deployed version. These guides explain vulnerability scope and point to vendor guidance for affected and fixed releases.
4 min read ·
React Server Components security: DoS and source code exposure after React2Shell
Why an early React2Shell patch may leave separate RSC issues unresolved: review CVE-2026-23864, denial of service and source code exposure remediation.
4 min read ·
Next.js October 2026 security update: RCE risks and deployment checks
Review the October 14 Next.js fixes for Cache Components RCE, CVE-2026-96889 image optimization RCE and Server Actions DoS, with a deployment checklist.
4 min read ·
Next.js next/og ImageResponse RCE: review dynamic social images
Assess the September 2026 next/og ImageResponse advisory, its Node.js and SVG conditions, and a practical patch checklist for dynamic social image routes.
4 min read ·
Next.js Windows server RCE: check hosting and deployed versions
Review GHSA-p293-qw3h-jr36, the August 2026 Next.js Windows-hosted server RCE advisory, and distinguish a Windows development laptop from production hosting.
4 min read ·
Next.js rewrites SSRF: review dynamic destination hostnames
Understand the July 2026 Next.js rewrite SSRF and redirect advisory, affected versions, and how to audit request-derived destination hostnames safely.
4 min read ·
CVE-2025-29927: Next.js middleware authorization bypass checklist
Review the March 2025 Next.js middleware authorization bypass, historical patch versions, and how to verify access controls beyond the login screen.
7 guides
Check exposure, patch and verify the result
Turn an advisory into a practical response: inspect your deployment, understand scan coverage and collect evidence that the intended fix is live.
5 min read ·
Does a clean website vulnerability scan rule out a new CVE?
Read website vulnerability scan findings, passed checks and unchecked coverage correctly. Learn what evidence you need before ruling out a new framework CVE.
5 min read ·
How to verify a React or Next.js security patch is deployed
A practical React and Next.js patch verification checklist: resolved dependencies, build artifacts, production replicas, preview URLs and evidence for closing a CVE ticket.
5 min read ·
Suspected RCE on your website: an incident response checklist
What website owners should do after suspected remote code execution: contain exposure, preserve evidence, review credentials, recover safely and verify the deployed fix.
5 min read ·
React2Shell vs Log4Shell vs Shellshock: which affects your website?
Compare React2Shell, Log4Shell and Shellshock by affected component, CVE and verification method. Identify the right advisory before choosing a website security check.
5 min read ·
Does a WAF protect against React2Shell? Why patching still matters
Understand what React2Shell WAF mitigations can establish, how to review protected hostnames and why firewall rules do not replace a verified framework patch.
5 min read ·
SCA vs DAST for a new CVE: which website check do you need?
Learn when dependency analysis and dynamic website testing answer different CVE questions, how to resolve conflicting results and what evidence to retain.
5 min read ·
Preview deployment security after a framework vulnerability advisory
Find forgotten preview and staging deployments after a React or Next.js advisory. Review artifact versions, access controls, credentials and retirement evidence.
Vulnerability checks: common questions
- Are React2Shell, React to Shell and React 2 Shell the same vulnerability?
- These naming variations can refer to React2Shell, commonly associated with CVE-2025-55182 in React Server Components. Use the CVE identifier and the React vendor advisory to establish the exact issue. A nickname alone does not identify every follow-up vulnerability or affected framework release.
- Is pcp2shell a confirmed vulnerability name?
- We have not verified an authoritative advisory under the name pcp2shell. It may be a reference to React2Shell, but that is an interpretation, not an identification. Check the original report, vendor and CVE before deciding whether your software is affected.
- Can a website scan tell me whether my site has a specific CVE?
- Only when the assessment includes an applicable check and the evidence supports that conclusion. MyPentest helps you investigate your site's security through its supported checks. Combine scan results with the deployed package inventory, configuration and vendor advisory when assessing a specific CVE. No findings does not mean every vulnerability was tested or excluded.
- Does every React or Next.js website need the same patch?
- No. Applicability depends on the advisory, installed packages, versions and features in use. Inspect the actual production deployment and follow the current guidance for that product and release line. Do not infer exposure solely from a browser-side technology label.
- What should I do after updating an affected dependency?
- Build and deploy the fix, confirm the production artifact contains the intended version, and retest the relevant behavior. Record what was checked and what remains unknown. If compromise is suspected, follow your incident response process; patching alone does not establish that an earlier intrusion has been removed.
Run a scan on your site. Review what the evidence shows.
Verify a domain you own, start a MyPentest assessment and review the findings from supported checks. For a named vulnerability, use your results alongside the vendor advisory and production version checks.