Critical React, Next.js flaw lets hackers execute code on servers
Recorded: Dec. 4, 2025, 4:02 p.m.
| Original | Summarized |
Critical React, Next.js flaw lets hackers execute code on servers News Featured North Korea lures engineers to rent identities in fake IT worker scheme Shai-Hulud 2.0 NPM malware attack exposed up to 400,000 dev secrets Microsoft "mitigates" Windows LNK flaw exploited as zero-day University of Phoenix discloses data breach after Oracle hack Russia blocks FaceTime and Snapchat over use in terrorist attacks Create compliance docs with this $40 governance & cybersecurity bundle CISA warns of Chinese "BrickStorm" malware attacks on VMware servers Contractors with hacking records accused of wiping 96 govt databases Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityCritical React, Next.js flaw lets hackers execute code on servers Critical React, Next.js flaw lets hackers execute code on servers By Bill Toulas December 4, 2025 A maximum severity vulnerability, dubbed 'React2Shell', in the React Server Components (RSC) 'Flight' protocol allows remote code execution without authentication in React and Next.js applications. Break down IAM silos like Bitpanda, KnowBe4, and PathAI Related Articles: Next.js Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Popular Stories ChatGPT is down worldwide, conversations disappeared for users Marquis data breach impacts over 74 US banks, credit unions Glassworm malware returns in third wave of malicious VS Code packages Sponsor Posts AI is a data-breach time bomb: Read the new report Hackers love the holidays! Share FREE Security Awareness Training to keep family & friends cyber-safe! Overdue a password health-check? Audit your Active Directory for free Empowering IT teams with intelligence driven cyber threat research. Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Critical React, Next.js Flaw Presents a Severe Server-Side Code Execution Risk A newly discovered vulnerability, dubbed “React2Shell,” poses a significant risk of remote code execution within React and Next.js applications. This flaw, identified by security researcher Lachlan Davidson, stems from insecure deserialization within the React Server Components (RSC) ‘Flight’ protocol. As of December 4, 2025, the issue has a severity score of 10/10, highlighting its critical nature. The vulnerability resides in React versions 19.0, 19.1.0, 19.1.1, and 19.2.0, along with experimental canary releases starting with Next.js 14.3.0-canary.77. The core issue is related to React Server, impacting the React Router RSC preview, RedwoodSDK, and Waku. Notably, the vulnerability also affects Next.js due to its implementation of the RSC “Flight” protocol. Impact and Prevalence According to Wiz cloud security, approximately 39% of cloud environments utilizing React or Next.js are affected by this vulnerability. This speaks to the widespread adoption of these frameworks in modern application development, particularly in cloud-based environments. The popularity of React itself—with a staggering 55.8 million weekly downloads on npm—and Next.js (16.7 million) underscores the scale of the potential impact. The Root Cause: Insecure Deserialization The vulnerability's genesis lies in the way React Server Components (RSC) handle incoming data. Specifically, the system fails to adequately validate the structure of RSC payloads received from clients. An attacker can exploit this by sending a malformed request, triggering the execution of privileged JavaScript code within the server’s context. Davidson created a React2Shell website, detailing the technical specifics of the vulnerability. He was cautious, noting that while proof-of-concept (PoC) exploits exist, an actual exploit does not require invoking functions like `vm#runInThisContext`, `child_process#exec`, or `fs#writeFile`. This mitigates some risk, but the underlying possibility remains. Severity and Mitigation – Urgent Action Required The risk posed by React2Shell is amplified by the ease with which it could be exploited. The fact that the vulnerability exists in the default configuration of the impacted packages emphasizes the urgency of remediation. To address this issue, developers are strongly advised to apply the fixes available in React versions 19.0.1, 19.1.2, and 19.2.1, alongside Next.js versions 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7 . Furthermore, organizations are urged to conduct thorough audits of their environments to identify any potentially vulnerable instances of React or Next.js. Prompt remediation – applying the available fixes – is paramount to mitigating the associated risks. Notable Observations The widespread use of React and Next.js in cloud environments makes this vulnerability a critical concern for many businesses. The security researcher’s efforts to document and share the details of React2Shell are crucial in accelerating the patching process. The inclusion of PoCs highlighted within the documentation, combined with Davidson's warnings about their limited functionality, underscore a thoughtful approach to security dissemination. It's important to note that this isn't simply a vulnerability within React or Next.js, but rather a systemic risk within the broader ecosystem of component-based web development. Libraries utilizing React Server – such as Vite RSC plugins, Parcel RSC plugins, and React Router RSC preview – also inherit this vulnerability. Moving forward, this incident will undoubtedly elevate the scrutiny placed on React Server Components and potentially shift developer thinking towards more robust security practices when designing and implementing RSCs. It’s a stark reminder that security must be considered at every level of the software development lifecycle. |