Since the latter half of 2025, software supply chain attacks have been surging, with the npm Shai-Hulud incident as a representative example. Accordingly, vulnerability response through CVEs has also become more stringent.
React Server Components are components related to the server functionality of the JavaScript library “React.” If this vulnerability is exploited, there is a risk that a remote attacker could execute arbitrary code. Note that other products such as “Next.js” are similarly affected.
For countermeasures against this issue, please feel free to contact XLsoft or the author of this document, Alex Wang (王 子龍), at https://jfrog.com/ja/platform/schedule-a-demo/ (available in both Japanese and English).
Why Is React2Shell So Dangerous?
The following characteristics are cited as reasons why this attack has an extremely serious impact.
Zero-Configuration Compromise – Attacks Targeting the Default State
This flaw exists in the core deserialization processing logic of the React Flight Protocol itself. Next.js applications are vulnerable in their default configuration. This is because the vulnerable App Router is used by default. A standard project generated with create-next-app immediately becomes a target for attack, even if the developer has not written a single line of custom code
This means that the vast majority of newly deployed applications and widely used applications are affected, making the attack surface extremely broad.
No Pre-Authentication Required (Pre-authentication)
Attackers do not require any credentials, session tokens, or user interaction. The malicious payload targets the React Flight Protocol, which is processed before the application’s own authentication logic is executed. All that is needed is to send a single crafted HTTP request to a server exposed to the internet.
Remote Code Execution with a High Success Rate
This exploit allows an attacker to gain complete control of the compromised server process. The attack success rate against vulnerable systems is nearly 100%, making it a “set it and forget it” attack method for attackers. The existence of reliable public PoC code makes it easy for attackers without advanced skills to exploit, causing large-scale attacks to expand rapidly. In fact, scanning and attack attempts in real environments have been confirmed within hours of disclosure.
JFrog user companies can easily respond to the above software supply chain attacks.
What Exactly Is the “React2Shell” Vulnerability Issue?
In December 2025, a critical React vulnerability, CVE-2025-55182 (and the corresponding CVE-2025-66478 in Next.js), was disclosed by React maintainers. This vulnerability was named “React2Shell” by the researchers who discovered it, and leads to arbitrary code execution by a remote (in some cases unauthenticated) attacker.
A remote attacker can craft a malicious HTTP request to any React Server Function endpoint, and achieve arbitrary code execution on the server when React deserializes it. The attack success rate in the default configuration is reported to be nearly 100%.
Initially, no PoC (proof of concept) exploit for this vulnerability had been released, but on December 4, 2025, an “unofficial” complete remote code execution exploit and technical analysis were published. Furthermore, the following day, the original PoC by the researcher themselves was also released. As a result, the likelihood of this vulnerability being exploited by external attackers has become extremely high.
December 9, 2025
The JFrog Security Research Team is continuing to track the React2Shell vulnerability. As a recent development, the original PoC (proof of concept) by the researcher who discovered this vulnerability has been released. This PoC demonstrates the ease of exploiting this CVE, reflecting the actual severity and magnitude of impact of this CVE.
The team continues to provide tracking and the latest information on React2Shell at research.jfrog.com.
December 12, 2025
Two high-severity denial of service (DoS) vulnerabilities, CVE-2025-55184 and CVE-2025-67779, were disclosed. These CVEs affect the same usage scenarios as React2Shell, but cannot be exploited as remote code execution (RCE). These CVEs affect both React and Next.js, and corresponding fixed versions have been newly released.
Who Is Affected by React2Shell?
React Servers Using React Server Function Endpoints
React servers using React Server Function endpoints have been confirmed to be vulnerable. You can determine whether you are using vulnerable functionality by checking whether the ‘use server’; directive is included in your application’s source code. This indicates that a Server Function is defined.
Example：
async function requestUsername(formData) {
'use server';
const username = formData.get('username');
// ...
}
export default function App() {
return (
<form action={requestUsername}>
<input type="text" name="username" />
<button type="submit">Request</button>
</form>
);
}React Servers Supporting React Server Components
The React advisory states the following:
“Even if your application does not implement React Server Function endpoints, it may be vulnerable if it supports React Server Components.” At this time, the exact conditions under which CVE-2025-55182 can be exploited simply by supporting React Server Components — even without using React Server Function endpoints — have not been clarified.
Therefore, if your application supports React Server Components in any form, it is strongly recommended to upgrade the affected components to a fixed version (see the table below).
| Vulnerable Component | Vulnerable Versions | Fixed Versions |
| react-server-dom-webpack | 19.0.0 19.1.0 – 19.1.1 19.2.0 | 19.0.1 19.1.2 19.2.1 |
| react-server-dom-parcel | 19.0.0 19.1.0 – 19.1.1 19.2.0 | 19.0.1 19.1.2 19.2.1 |
| react-server-dom-turbopack | 19.0.0 19.1.0 – 19.1.1 19.2.0 | 19.0.1 19.1.2 19.2.1 |
| Next.js | 15.0.0 – 15.0.4 15.1.0 – 15.1.8 15.2.0 – 15.2.5 15.3.0 – 15.3.5 15.4.0 – 15.4.7 15.5.0 – 15.5.6 16.0.0 – 16.0.6 | 15.0.5 15.1.9 15.2.6 15.3.6 15.4.8 15.5.7 16.0.7 |
| Next.js | Canary versions from 14.3.0-canary.77 onwards | Run npm install next@14 to downgrade to the latest stable 14.x release. |
| Other frameworks | Frameworks/libraries that bundle a vulnerable React RSC implementation (e.g., Vite RSC plugin, Parcel RSC plugin, React Router RSC preview, RedwoodSDK, Waku) |
Next.js Web Applications Using App Router
The most likely attack vector is Next.js web applications (CVE-2025-66478). This is because they are vulnerable with their default configuration.
For example, when you create a Next.js application using the standard create-next-app command with the recommended default configuration, the Next.js App Router is enabled. This makes the vulnerable React Server Function endpoints accessible. Such Next.js applications include an app directory, which means they are using the vulnerable App Router.
How Can React2Shell Be Mitigated (Addressed)?
The most reliable way to resolve CVE-2025-55182 and CVE-2025-66478 is to upgrade the affected packages to one of the fixed versions listed in the table above.
Even if you cannot upgrade immediately, the following workaround can render this vulnerability non-exploitable:
- Next.js Applications
If you are not using many App Router features, you can revert (migrate) to the Pages Router by following the Next.js App Router migration guide.
Addressing Software Supply Chain Vulnerabilities Using JFrog
What Is the JFrog Platform?
The “JFrog Platform” is an integrated platform provided by JFrog for centrally managing build artifacts, dependencies, and licenses from software build to release, and for enforcing security governance. Both self-hosted and SaaS versions are offered.
Whereas conventional tools were divided into individual roles such as “artifact management” and “security,” the JFrog Platform is characterized by covering everything from development to operations end-to-end.
JFrog Artifactory
JFrog Artifactory is a repository manager for streamlining the management of artifacts in software development. Artifactory is a powerful tool for handling binary files and libraries, playing a particularly important role in DevOps environments and CI/CD pipelines. It supports over 30 package management systems, including Maven, npm, Docker, NuGet, PyPI, and Hugging Face, allowing different technology stacks to be managed centrally.
- Remote Repositories
By configuring remote repositories, Artifactory can centrally cache packages from external repositories (e.g., Maven Central, npm registry, etc.) via proxy. This reduces network load when managing dependencies and improves build stability. - Local Repositories
You can use local repositories to manage binaries and artifacts generated by projects and teams. This makes version management and storage of artifacts easier, facilitating reuse and sharing.
JFrog Xray
JFrog Xray is a tool for strengthening artifact security and compliance, used in conjunction with Artifactory. Xray can scan the vulnerabilities of libraries and dependencies used within the software development process and assess risks.
- Vulnerability Scanning
Xray scans open source libraries and components contained in artifacts and identifies known vulnerabilities. This information is updated from the NVD (National Vulnerability Database) and JFrog’s proprietary database. - Compliance Management
It has a function to check whether the open source components used comply with license policies. This automatically detects the use of components with specific licenses and manages risk. - Deep Scan
It deeply analyzes artifacts, tracing the hierarchy of dependencies to obtain vulnerability and license information for each component. - Automatic Alerts and Notifications
When a new vulnerability or compliance issue is discovered, notifications are sent to the team via the configured alert function, enabling rapid response. - Dashboards and Reports
Xray has a dashboard that allows you to grasp the vulnerability and compliance situation at a glance, and can generate detailed reports. This facilitates risk management decision-making.
JFrog Curation
When caching external dependencies via Artifactory’s remote repositories, Curation acts as a firewall to monitor policy-violating actions, and depending on the policy settings, a cache block or a DryRun approval flow occurs.
In addition, the Curation catalog feature allows you to examine vulnerability information data for the open source packages you use. You can check version history, security vulnerabilities, OpenSSF scores, license data, operational risks, and the presence of dependencies and transitive vulnerabilities. Over 12 million OSS packages are cataloged and can be easily referenced.
Response Procedures
- Integrate Artifactory with CI, route external package downloads during builds through the Artifactory Remote Repo, and store the built artifact binaries in the Artifactory Local Repo. JFrog provides a CLI for each CI tool, and you can configure it easily using the Virtual Repo feature.
- Use the Xray feature to perform vulnerability scans of cached OSS and vulnerability scans of built artifacts. Furthermore, by setting Xray policies, you can prevent secondary spread by issuing alerts and blocking downloads when there is a policy violation in the built artifacts.
- Set policies on the Curation feature to create a firewall when caching in the Remote Repo. Since JFrog has scan sensors installed in each OSS community, it eliminates risks in real time.
For questions about this article or JFrog, please contact XLsoft, the authorized JFrog distributor in Japan.
This article has been created and published with permission from JFrog.
Click here to subscribe to the email newsletter from XLsoft, which provides popular software from around the world.
