Defending against the CVE-2025-55182 (React2Shell) vulnerability in React Server Components

CVE-2025-55182, also known as React2Shell, is a critical pre-authentication remote code execution vulnerability affecting React Server Components, Next.js and related frameworks, with a CVSS score of 10.0. Exploitation activity was detected as early as December 2025, with many successful attempts originating from red team assessments and real-world campaigns delivering multiple payloads, including coin miners, and affecting both Windows and Linux environments.

The flaw exists because affected React Server Components fail to validate incoming payloads, enabling attackers to inject malicious structures that lead to prototype pollution and remote code execution. According to Microsoft Defender Security Research Team, mitigation emphasises patching to patched versions—React 19.0.1, 19.1.2 and 19.2.1, and Next.js updates across release lines—alongside prioritising internet-facing assets and employing Defender monitoring and Azure WAF where feasible.

Manual exposure checks, vulnerability management guidance, and detection queries are provided to help organisations identify affected packages, validate versions, and monitor for exploitation attempts.