Unpacking React2Shell: How a CVSS 10.0 Vulnerability Rocked React Server Components and Reshaped Web Security Best Practices

The landscape of modern web development, increasingly defined by server-driven UI paradigms, faced a critical challenge with the discovery of "React2Shell," a severe remote code execution (RCE) vulnerability within React Server Components (RSCs). Cataloged as CVE-2025-55182, this flaw achieved a maximum CVSS score of 10.0, indicating its extreme severity: unauthenticated attackers could gain full shell access to affected systems with a single, specially crafted HTTP request. The vulnerability, rooted in the custom Flight protocol used by RSCs for streaming interactive UIs, exposed fundamental structural risks inherent in custom deserialization systems, prompting an urgent reevaluation of security practices across the React ecosystem and beyond.

Understanding React Server Components and the Flight Protocol

React Server Components represent a significant evolution in web development, aiming to bridge the gap between traditional server-side rendering (SSR) and client-side interactivity. Unlike conventional React components that render entirely on the client or generate static HTML on the server, RSCs allow developers to build components that execute exclusively on the server, fetching data and rendering parts of the UI before sending them to the client. This approach promises enhanced performance, reduced client-side bundle sizes, and simplified data management by keeping sensitive logic and large dependencies on the server.

Central to RSCs’ operation is the Flight protocol, a bespoke streaming mechanism designed to transmit not just data, but instructions for reconstructing a dynamic UI on the client. It’s a line-delimited format, distinct from standard HTML or JSON, comprising a unique type system, reference resolution, and rules for assembling executable behavior. Most developers, shielded by the framework’s abstraction, rarely inspect a Flight payload. It appears as a mix of JSON fragments, dollar-sign-prefixed references, and module pointers that the React runtime silently reassembles into a live component tree. This intricate process, while powerful, inherently involves deserialization—the reconstruction of complex objects or behaviors from a stream of bytes or text—a notorious source of security vulnerabilities throughout software history.

The Unveiling of React2Shell: A CVSS 10.0 Threat

The critical nature of the Flight protocol’s deserialization layer became starkly apparent with the disclosure of CVE-2025-55182 in December 2025. Dubbed "React2Shell" by the security community, this flaw represented an unauthenticated remote code execution vulnerability, meaning an attacker required no prior credentials or session to compromise a target system. Durgesh Pawar, a prominent security researcher, initiated a deep dive into the Flight protocol’s internals following the CVE’s announcement, scrutinizing functions like getOutlinedModel and getChunk in the React source code.

The root cause of React2Shell lay in a seemingly innocuous oversight within the getOutlinedModel function, specifically in the server-side reply handling code (ReactFlightReplyServer.js). This function is tasked with resolving deep property paths specified by the $:reference system within the Flight stream. When processing a reference such as $1:user:name, the parser would split the path by colons and sequentially access each segment on the parent object. The critical flaw was the absence of a hasOwnProperty check within this traversal loop:

for (key = 1; key < reference.length; key++)
    parentObject = parentObject[reference[key]];

This omission allowed attackers to manipulate the prototype chain. By injecting path segments like __proto__ or constructor into the $:reference, an attacker could traverse from a benign JavaScript object up to Object.prototype, then to the Object constructor, and finally to the Function constructor. In JavaScript, Function("arbitrary code")() acts akin to eval(), providing a direct path to arbitrary code execution.

The full exploitation, detailed by security firm Resecurity, involved a sophisticated gadget chain leveraging several Flight protocol features:

1. Arbitrary Prototype Pollution: The attacker sends a crafted Flight payload containing a $:reference like $1:__proto__:constructor:constructor, leading to the Function constructor.
2. Function Constructor Access: Through this path, the attacker gains a reference to the Function constructor, which can be used to execute arbitrary JavaScript code.
3. Client-Side Code Execution: The attacker then injects malicious JavaScript code via this Function constructor, which is executed on the server during the deserialization process of a Server Action. This execution happens pre-authentication and pre-application logic.
4. Remote Code Execution: The executed JavaScript code can then interact with the underlying Node.js environment, allowing for command execution on the server, leading to a full shell compromise.

This sophisticated chain highlighted the inherent danger of custom deserialization systems that reconstruct executable behavior without rigorous validation at every step. The impact was profound:

• CVSS 10.0: Maximum severity, signifying complete compromise.
• Unauthenticated RCE: No login required, making every exposed React Server Component endpoint a potential entry point.
• Zero-Day Exploitation: Rapid weaponization in the wild, underscoring the immediate threat.

Immediate and Widespread Exploitation

The disclosure of React2Shell was immediately followed by evidence of its active exploitation. The federal Cybersecurity & Infrastructure Security Agency (CISA) promptly added CVE-2025-55182 to its Known Exploited Vulnerabilities (KEV) catalog, a clear indicator of the threat’s severity and active weaponization.

Security firm Sysdig published research linking in-the-wild exploitation to North Korean state-sponsored actors. These sophisticated groups rapidly weaponized the vulnerability, deploying EtherRAT, a novel file-less implant that leverages the Ethereum blockchain for command-and-control (C2) communications—a technique dubbed "EtherHiding." This innovative C2 method makes takedown efforts incredibly challenging, as the blockchain infrastructure is inherently resilient to traditional law enforcement actions.

Separately, Palo Alto Networks’ Unit 42 documented KSwapDoor, another backdoor exploiting React2Shell. KSwapDoor cleverly masquerades as [kswapd1] on compromised Linux systems, blending into process lists alongside the legitimate kswapd0 kernel swap daemon. Unit 42’s analysis revealed KSwapDoor’s use of RC4 encryption for internal strings and configuration, with C2 communications secured via AES-256-CFB and Diffie-Hellman key exchange over a peer-to-peer mesh network. The speed and sophistication of these campaigns, deploying advanced implants through a single unauthenticated HTTP request, underscored the critical urgency of patching.

The React Team’s Response and Subsequent Vulnerabilities

The React development team responded swiftly, issuing patches for CVE-2025-55182 across multiple versions of React. The core fix involved caching the genuine hasOwnProperty method at module load time (var hasOwnProperty = Object.prototype.hasOwnProperty;) and then using hasOwnProperty.call(value, i) for all property checks in the deserialization path. This ensures that even if an attacker manipulates hasOwnProperty on a malicious object, the original, untampered prototype method is invoked, effectively blocking the prototype chain traversal gadget. This crucial fix was shipped in React 19.0.1, 19.1.2, and 19.2.1.

However, React2Shell proved to be a symptom of deeper structural issues within the Flight protocol’s deserialization logic. The intense security audits that followed uncovered a series of related vulnerabilities, none as severe as the RCE, but cumulatively significant:

• CVE-2025-55184 (DoS, CVSS 7.5): Disclosed shortly after React2Shell, this vulnerability allowed attackers to trigger an infinite recursion of nested Promises during Server Function deserialization, effectively hanging the Node.js event loop and causing a denial of service. Fixed in React 19.0.2, 19.1.3, 19.2.2.
• CVE-2025-67779 (DoS, CVSS 7.5): This CVE represented an incomplete fix for CVE-2025-55184. Researchers found new edge cases that allowed the same infinite loop to be triggered, necessitating a second round of patching. Fixed in React 19.0.4, 19.1.5, 19.2.4.
• CVE-2026-23864 (DoS/OOM, CVSS 7.5): Revealed in January 2026, this vulnerability exploited unbounded request body buffering and "zipbomb"-style decompression attacks, leading to memory exhaustion and denial of service. Fixed in React 19.0.4+, 19.1.5+, 19.2.4+.
• CVE-2025-55183 (Information Disclosure, CVSS 5.3): A subtle but impactful flaw, this allowed crafted requests to reflect Server Function source code back to the attacker. If a Server Function implicitly or explicitly stringified one of its arguments (e.g., for logging or debugging), a specially crafted argument could cause the deserialization parser to return the function’s own source code, potentially exposing business logic, database queries, and hardcoded secrets. Fixed in React 19.0.1, 19.1.2, 19.2.1.
• CVE-2026-27978 (CSRF Bypass, CVSS 5.3): This bug affected Next.js’s Server Action handling. Next.js typically validates Origin and Host headers to prevent cross-site request forgery. However, when a request originated from a sandboxed <iframe>, browsers send Origin: null. The Next.js parser in action-handler.ts incorrectly treated the string 'null' as a missing origin rather than an explicit cross-origin indicator, allowing attackers to invoke Server Actions with a victim’s authenticated session cookies. Fixed in Next.js 16.1.7.

This cascade of vulnerabilities underscores the inherent complexity and fragility of custom deserialization logic, even in widely used and meticulously developed frameworks. While the React team’s commitment to patching was swift and thorough, the iterative nature of the fixes highlighted the challenge of securing such a fundamental layer.

Fortifying React Applications: Essential Defenses

Beyond relying solely on framework patches, developers must adopt a multi-layered security approach to protect their React Server Component applications. The following defenses are ranked by their practical impact:

1. Robust Input Validation on Server Actions (Zod, Valibot): This is the most critical application-level defense. The Flight deserializer processes raw, untrusted network input before application code takes control. Strict schema validation, using libraries like Zod or Valibot, must be the first operation within every Server Action. This includes validating types, shapes, string lengths, numeric bounds, and enumerated values. It is crucial to use safeParse() to prevent internal error details from being exposed. Importantly, if a Server Action accepts a plain object, the entire object should be validated before any destructuring, as destructuring accesses properties on potentially malicious, unvalidated input.

2. Enforcing Server-Side Code Integrity with server-only: The server-only package acts as a build-time guardrail. By importing server-only at the top of files containing sensitive logic (database credentials, API keys, internal business functions), developers prevent these modules from being accidentally bundled into client components. If a client component attempts to import such a file, the build process will fail. This prevents code leakage, but developers must remember it doesn’t prevent sensitive data from being passed as props to client components; explicit data filtering remains essential.

3. Layered CSRF Protections: Given the Origin: null bypass (CVE-2026-27978), relying solely on framework defaults for CSRF protection is insufficient. For state-changing Server Actions, developers should implement additional layers:

   • Cookie Configuration: Ensure session cookies are set with SameSite=Strict or SameSite=Lax.
   • Explicit CSRF Tokens: For high-value operations, generate and validate per-session CSRF tokens, embedding them in hidden form fields or custom headers.
   • allowedOrigins Caution: Never add 'null' to experimental.serverActions.allowedOrigins in Next.js configuration, as this reintroduces the CSRF bypass vulnerability. Correct Origin and Host header configuration in reverse proxies is the appropriate solution for legitimate cross-origin requests.

4. Verifying hasOwnProperty Patch Adoption: Developers must confirm their React installations are running patched versions. Specifically, React 19.0.1, 19.1.2, or 19.2.1 (for the RCE fix) and later versions (19.0.4+, 19.1.5+, 19.2.4+ for DoS fixes) are necessary. Regular dependency auditing and updates are non-negotiable.

5. Strategic Use of the Taint API: React’s taintObjectReference and taintUniqueValue functions provide development-time guardrails. They mark objects or strings as sensitive, causing an error if they attempt to pass through the Flight serializer to the client. While useful for catching accidental data leakage during development, it’s crucial to understand that taint tracking is reference-based. Any data transformation (spreading, property access, JSON.parse(JSON.stringify())) breaks the taint, making it a valuable debugging and linting tool, but not a primary security boundary against malicious intent.

6. Augmenting Security with Web Application Firewalls (WAFs): WAFs can serve as an additional detection layer. They can be configured to inspect POST requests with the Next-Action header for patterns indicative of prototype pollution (__proto__, constructor:constructor), flag error responses leaking internal details (E{"digest"), and block excessively large payloads to mitigate DoS attacks. However, WAFs are not a panacea. Sophisticated attackers can bypass them using techniques like padding payloads beyond WAF inspection buffers or employing chunked transfer encoding. WAFs should be seen as a valuable noise-reduction and early warning system, not a definitive security boundary.

Lingering Structural Risks and Future Attack Vectors

Despite the patches, some risks are structural, inherent to Flight’s design:

• Man-In-The-Middle (MITM) on the Flight Stream: If an attacker can intercept and modify the Flight stream (e.g., via CDN compromise or rogue proxy), they can inject malicious instructions. The plain-text nature of the protocol makes this feasible. An attacker could redirect component loading ($I rows), embed hidden RPC triggers ($F tags), or modify component props (D rows), potentially leading to XSS if dangerouslySetInnerHTML is used. While Flight escapes $ prefixes in user-supplied data, this doesn’t protect against direct manipulation of the protocol by a MITM attacker.

• Server Action Enumeration: Server Action IDs are obfuscated hashes. However, the server-reference-manifest.json file maps these IDs back to their source implementations. If this manifest is exposed (due to misconfigured hosting, an exposed .next directory, or path traversal), attackers gain a complete API map, enabling IDOR (Insecure Direct Object Reference) and parameter tampering attacks. This exposes Server Actions to blind trust issues, as developers might implicitly trust inputs originating from React’s internal machinery without sufficient validation.

• Encrypted Closure Tampering: Next.js encrypts variables captured by Server Actions from their surrounding scope (closures) before sending them to the client, using a key from NEXT_SERVER_ACTIONS_ENCRYPTION_KEY. If this key, especially if static in multi-server setups, is extracted by an attacker (e.g., via file read access or SSRF), they can decrypt, modify (e.g., changing userId or role), and re-encrypt the closure state. The server would then accept this forged closure as legitimate.

• Supply Chain Activation via Module IDs: Flight references client components by module ID. If a compromised npm package, though not explicitly imported by application code, exists in the bundled output, an attacker capable of injecting $I import references into the Flight stream (via MITM or cache poisoning) could potentially force the client to load and execute this dormant malicious module. The efficacy of this vector depends on whether there are robust chunk-level validations in place that have not yet been publicly identified.

A Recurring Pattern in Software Security

The React Flight vulnerabilities are not an isolated incident but rather the latest iteration of a recurring pattern in software security. Frameworks that introduce custom serialization formats for rich, stateful, or executable server-client communication have historically become attack surfaces.

• Google Web Toolkit (GWT): GWT used a custom RPC protocol to synchronize Java objects. Security researchers at BishopFox demonstrated how manipulating this wire format could lead to arbitrary deserialization and RCE, eventually forcing GWT to disable binary serialization.
• Java Server Faces (JSF) and ASP.NET ViewState: Both frameworks serialized server-side ViewState to the client as a hidden form field. When cryptographic signing was weak or missing, attackers could tamper with this serialized state, achieving remote code execution. Microsoft and Oracle had to issue repeated patches to address the underlying pattern.

In each instance, the core assumption was that the server was the sole trusted producer of the data, and the client a trusted consumer. This assumption invariably breaks down when an attacker can manipulate the wire format in transit or trick the server into deserializing attacker-controlled input. React Flight, while innovative, has fallen prey to the same fundamental challenge.

Looking Ahead: Towards More Resilient Server-Driven UIs

The React Flight protocol is a powerful innovation, solving complex problems related to streaming interactive component trees and enabling progressive hydration, async data loading, and server-driven code splitting. However, its reliance on serializing executable references, async state, module pointers, and RPC endpoints over a streaming text protocol, with implicit trust in the stream’s structure, has proven to be a significant security risk.

The swift patches from the React team have addressed known gadget chains and denial-of-service vectors. Yet, the underlying design decision to expose arbitrary property traversal ($:) and executable Thenable reconstruction ($@) through a network-facing protocol, especially without initially robust ownership validation, represents a design choice that proved problematic. The industry must move beyond simply patching symptoms. As more frameworks adopt server-driven UI patterns, the need for stronger security primitives becomes paramount. This includes cryptographic validation of serialized payloads, signed component trees, and comprehensive content integrity checks on the Flight stream itself. Relying solely on the parser to handle every edge case has a poor historical track record. Developers utilizing React Server Components are urged to familiarize themselves with the internals of react-client/src/ReactFlightClient.js to understand precisely what their framework is trusting on their behalf. The lessons from React2Shell are a stark reminder that innovation must be coupled with rigorous security architecture from the outset.