In December 2025, researchers disclosed CVE-2025-55182, nicknamed React2Shell. It's a maximum-severity flaw (CVSS 10.0) in React Server Components, the server-side rendering approach used by React 19 and modern Next.js apps. The problem: data sent from a browser gets deserialized on the server in a way that lets an attacker run their own code with a single crafted request. No login required.
This wasn't theoretical. Exploitation was observed as early as December 5, mostly dropping cryptocurrency miners onto vulnerable servers. Fixed versions (React 19.0.1, 19.1.2, and 19.2.1) are available.
If your site or app was built on React Server Components or a recent Next.js, this is a patch-now situation, not a next-quarter one. The practical lesson for any small business is simpler: you need to know what your website is built on and who's responsible for keeping it patched. "It just works" is fine until a flaw like this appears and the answer to "who updates it" is nobody.
Further reading: original source ↗
Want this handled for you?
This is exactly the kind of thing our website security work takes off your plate. Start with a free, no-pressure look at your site.
Come aboard