Collected research
React2Shell: JavaScript's Long-Awaited Deserialization Flight-mare (CVE-2025-55182)
React2Shell (CVE-2025-55182)
The finder's page for React2Shell, an unauthenticated remote code execution flaw in server-side React reached through Server Component endpoints and tracked separately for Next.js because Next.js vendors React. It gives the disclosure timeline, links the original proof of concept, and warns that most circulating exploits and scanner results are invalid.
Record
- Document
- React2Shell (CVE-2025-55182)
- Researcher
- Lachlan Davidson
- Published by
- react2shell.com
- Topic
- Server
In the archive
Related sources
- Discovering React2Shell Whitepaper
- PoC Repository
- Critical Security Vulnerability in React Server Components
- Next.js security advisory Advisory
- React security advisory Advisory
- Follow-up: denial of service and source exposure
- Expo mitigation guidance
- Waku migration guidance
Tags
This page is the archive's own catalogue record. The research is the work of Lachlan Davidson, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .