React2Shell: Unmasking the CVSS 10.0 Vulnerability That Exposed React Server Components to Remote Code Execution

The landscape of web development has been profoundly reshaped by the advent of React Server Components (RSCs), a paradigm shift designed to enhance performance and developer experience by enabling components to render on the server. However, this innovative approach, particularly its reliance on a custom streaming protocol named Flight, introduced a critical vulnerability that shook the security community: CVE-2025-55182, notoriously dubbed "React2Shell." This unauthenticated remote code execution (RCE) flaw, carrying a maximum CVSS score of 10.0, highlighted the inherent dangers of custom deserialization systems and the complex security implications of server-driven UI architectures.

The Rise of React Server Components and the Flight Protocol

React Server Components emerged as a solution to address performance bottlenecks and improve initial page load times in single-page applications. By allowing developers to render components on the server and stream them to the client, RSCs aim to reduce the amount of JavaScript shipped to the browser, leverage server-side data fetching, and facilitate progressive hydration. This ambitious vision necessitated a novel communication mechanism, distinct from traditional HTML or JSON.

Enter the Flight protocol. Unlike conventional data formats, Flight is a custom, line-delimited streaming protocol designed to efficiently transmit an interactive UI tree. It boasts its own type system, reference resolution, and rules for reconstructing executable behavior on the client. When a server component renders, what travels over the network is not static HTML or a simple JSON object, but a dynamic stream of Flight payloads. For most developers, this intricate process operates silently in the background, a "black box" handled entirely by the React runtime. This abstraction, while simplifying development, inadvertently fostered a sense of implicit trust in the framework’s internal workings, masking the powerful deserialization capabilities at its core.

The Unveiling of React2Shell (CVE-2025-55182)

The security community’s attention was sharply drawn to the Flight protocol in December 2025, with the disclosure of CVE-2025-55182. This vulnerability, swiftly nicknamed "React2Shell," revealed an unauthenticated remote code execution flaw deeply embedded within the Flight deserialization layer. Its CVSS 10.0 rating signified the highest possible severity: an attacker could achieve full shell access to a vulnerable server with a single, unauthenticated HTTP request targeting a Server Function endpoint. No prior authentication, no complex prerequisites – just a crafted request and immediate compromise.

Durgesh Pawar’s initial breakdown illuminated the mechanics behind this critical flaw, demonstrating how protocol manipulation could lead to devastating consequences. The vulnerability was not merely a trivial parsing error but a symptom of a broader structural risk inherent in systems that reconstruct executable behavior from untrusted input. The federal Cybersecurity & Infrastructure Agency (CISA) promptly added CVE-2025-55182 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring its immediate and severe threat to national security and critical infrastructure. This move signaled to government agencies and private enterprises alike that patching this vulnerability was a top priority.

Dissecting the Flight Protocol: A Deserialization System

To comprehend the depth of React2Shell, one must first understand the Flight protocol’s structure. Observing a Flight payload in a browser’s network tab reveals a mix of JSON fragments, dollar-sign-prefixed references, and module pointers. Each line, or "row," is self-contained and processed by the client-side React runtime as it arrives.

The fundamental row format consists of <ROW_ID>:<ROW_TAG><PAYLOAD>n. The ROW_ID is a numeric identifier for cross-referencing, while the ROW_TAG is a single character (or short string) dictating the payload’s type. Common tags include:

• J: JSON Tree for serialized virtual DOM nodes, component props, and HTML elements.
• M: Module metadata for Client Component modules.
• I: Import directives instructing the client to load modules from the bundler’s chunk map.
• HL: Hint/Preload for browser resources like stylesheets.
• D: Data for server-rendered element context and environment information.
• E: Error for serialized server-side exceptions.

The true complexity and, critically, the attack surface, reside in the $ prefix system. When the client-side parser (specifically, functions like parseModelString in ReactFlightClient.js) encounters a string beginning with $, it triggers a type-specific resolution path instead of treating it as literal text. This mechanism allows the protocol to specify a wide array of dynamic behaviors:

• $: Model Reference, pointing to another chunk in the stream.
• $:: Property Access, enabling traversal into resolved chunk properties (e.g., $1:user:name).
• $S: Symbol, for creating native JavaScript Symbol objects.
• $F: Server Reference, representing callable Server Actions as RPC endpoints.
• $L: Lazy Component, deferring component loading.
• $@: Promise/Raw Chunk, returning the internal Chunk wrapper object, exposing framework plumbing.
• $B: Blob/Binary, triggering a blob deserialization handler.

This $ prefix system transforms Flight from a mere data format into a sophisticated deserialization system capable of reconstructing not just data, but behavior. It dictates which client-side code loads, which functions are invoked, and which internal states are exposed. This architectural pattern bears a striking resemblance to historical deserialization systems that have consistently been a source of critical vulnerabilities across various programming languages.

The Mechanics of Exploitation: Prototype Pollution and Thenables

The vulnerability behind React2Shell centered on two core JavaScript characteristics: prototype pollution and the "Thenable" duck-typing mechanism.

JavaScript’s prototype-based inheritance means every object implicitly links to a prototype, and property lookups traverse this chain. If an attacker can inject __proto__ or constructor.prototype as a key during object reconstruction, they can modify shared base prototypes, influencing all objects inheriting from them. This is precisely what the Flight protocol’s $: prefix, coupled with a missing validation, enabled.

The getOutlinedModel function, particularly within the server-side reply handling (in ReactFlightReplyServer.js), was responsible for resolving deep property paths like $1:user:name. The critical flaw lay in its loop:

for (key = 1; key < reference.length; key++)
    parentObject = parentObject[reference[key]];

This two-line snippet lacked a crucial hasOwnProperty check, meaning it would traverse the prototype chain if a path segment was not directly on the object. An attacker could supply a path like $1:__proto__:constructor:constructor, effectively navigating from a benign JSON object up through Object.prototype, to the Object constructor, and finally to the Function constructor. In JavaScript, Function("arbitrary code")() acts as an eval() equivalent, allowing for arbitrary code execution. The absence of property name allowlisting or checks for sensitive prototype properties like __proto__ proved fatal.

While initial investigations by researchers like Pawar also explored .$F (Server Action forging) as a potential attack vector, the $: property traversal emerged as the primary enabler of the RCE. The .$@ prefix, exposing raw internal Chunk objects, also represented a significant design flaw by revealing framework internals, though it wasn’t the direct trigger for the React2Shell RCE chain.

Real-World Impact and State-Sponsored Attacks

The CVSS 10.0 score of React2Shell was not theoretical; its real-world exploitation was immediate and widespread. Within hours of the December 2025 disclosure, sophisticated threat actors weaponized the vulnerability. Sysdig published research linking in-the-wild exploitation to North Korean state-sponsored groups deploying EtherRAT, a novel file-less implant. EtherRAT notably leveraged the Ethereum blockchain for command-and-control (C2) communications, a technique dubbed "EtherHiding." This innovative C2 method made detection and takedown exceptionally challenging, as the blockchain itself cannot be seized.

Separately, Palo Alto Networks’ Unit 42 documented KSwapDoor, another backdoor observed on infected Linux systems. KSwapDoor cleverly masqueraded as [kswapd1] to blend in with legitimate kernel processes. Its sophisticated design included RC4 encryption for internal strings and configuration data, while C2 communications were secured with AES-256-CFB and Diffie-Hellman key exchange over a peer-to-peer mesh network. The rapid deployment and advanced tradecraft of these state-sponsored campaigns underscored the extreme severity of the React2Shell vulnerability, emphasizing that a CVSS 10.0 deserialization flaw demands immediate, not deferred, patching.

The React Team’s Response and Subsequent Disclosures

The React team responded swiftly and decisively. The core fix for CVE-2025-55182 was a targeted patch that cached the genuine hasOwnProperty method at module load time (var hasOwnProperty = Object.prototype.hasOwnProperty;). All subsequent property checks in the deserialization path then explicitly invoked this cached reference using .call(), effectively neutralizing prototype pollution even if an attacker attempted to shadow hasOwnProperty on a malicious object. This critical patch shipped in React versions 19.0.1, 19.1.2, and 19.2.1.

While effective against the known gadget chain, this fix primarily addressed the symptom rather than a fundamental redesign of the property traversal model. The $: prefix still allows colon-separated path traversal, albeit with enhanced ownership validation. This structural aspect remains a point of concern for future vulnerabilities.

React2Shell also triggered a cascade of further security audits, leading to the disclosure of several related vulnerabilities in the Flight deserialization surface, none as severe as the original RCE but still requiring immediate attention:

• CVE-2025-55184 (DoS, CVSS 7.5): Infinite recursion of nested Promises in Server Function deserialization, capable of hanging the Node.js event loop. Fixed in 19.0.2, 19.1.3, 19.2.2.
• CVE-2025-67779 (DoS, CVSS 7.5): An incomplete fix for CVE-2025-55184, demonstrating the difficulty of patching complex deserialization logic. Fixed in 19.0.4, 19.1.5, 19.2.4.
• CVE-2026-23864 (DoS/OOM, CVSS 7.5): Unbounded request body buffering leading to memory exhaustion, akin to a zipbomb attack. Disclosed in January 2026. Fixed in 19.0.4+, 19.1.5+, 19.2.4+.
• CVE-2025-55183 (Info Disclosure, CVSS 5.3): A subtle bug where crafted requests could reflect Server Function source code if the function stringified an argument. This exposed business logic, database queries, and hardcoded secrets. Fixed in 19.0.1, 19.1.2, 19.2.1.
• CVE-2026-27978 (CSRF Bypass, CVSS 5.3): A flaw in Next.js’s Server Action handling where Origin: null (sent by sandboxed iframes) was incorrectly treated as a missing origin rather than a cross-origin indicator. Fixed in Next.js 16.1.7.

This flurry of subsequent patches underscores that React2Shell was not an isolated incident but a gateway to understanding a broader class of vulnerabilities inherent in custom serialization mechanisms.

Broader Implications: The Deserialization Risk

The saga of React2Shell echoes a recurring theme in software security: custom serialization formats designed for rich, stateful data transfer often become potent deserialization sinks. Historically, frameworks across various languages have grappled with similar challenges:

• Java’s ObjectInputStream: Famously exploited by tools like ysoserial, leading to widespread RCEs.
• Python’s pickle: Known for executing arbitrary code during load().
• PHP’s unserialize: Vulnerable to object injection attacks by chaining __wakeup and __destruct methods.
• .NET’s BinaryFormatter: Eventually deprecated due to persistent security issues.
• Google Web Toolkit (GWT), Java Server Faces (JSF), ASP.NET ViewState: All faced significant deserialization vulnerabilities where attackers manipulated custom wire formats or serialized state to achieve RCE.

The pattern is consistent: a framework develops a proprietary format to move complex, sometimes executable, data between trusted server and client. The assumption of server-as-sole-producer and client-as-trusted-consumer proves fragile. Attackers eventually demonstrate manipulation of the wire format or trick the server into deserializing malicious input. React Flight, while innovative, is the latest chapter in this long-standing security narrative.

Proactive Defenses Against Structural Risks

Securing applications built with React Server Components requires a multi-layered approach, moving beyond sole reliance on framework patches. The following defenses, ranked by impact, are crucial for mitigating structural risks:

1. Strict Input Validation on Server Actions (Zod, Valibot): This is the most impactful application-level defense. Every Server Action must begin with rigorous schema validation (e.g., using Zod or Valibot) before any business logic executes. This means validating types, shapes, lengths, numeric bounds, and enumerated values. Crucially, use .safeParse() to avoid leaking internal error details, and validate the entire argument object before destructuring its properties, as destructuring on unvalidated input can itself expose vulnerabilities.

2. The server-only Package: Import "server-only" at the top of any file containing sensitive logic (database credentials, raw API calls). This package acts as a build-time guardrail, failing the build if a Client Component attempts to import server-only code, preventing accidental leakage. Developers must be wary of "barrel files" that re-export both client-safe and server-only modules, as this can inadvertently bypass the protection. It’s also vital to remember that server-only prevents code leakage, not data leakage; sensitive data returned by server components must still be explicitly filtered before being passed to client components.

3. Enhanced CSRF Protections: Beyond Next.js’s default Origin vs. Host header checks, additional layers are necessary for state-changing Server Actions. Configure session cookies with SameSite=Strict or SameSite=Lax. For high-value operations, implement explicit, per-session CSRF tokens, embedded in hidden form fields or custom headers, and validate them on the server. Critically, never add 'null' to experimental.serverActions.allowedOrigins in Next.js config, as this reopens the CVE-2026-27978 Origin: null bypass.

4. Verify hasOwnProperty Patch: Ensure your React installation runs patched versions (React 19.0.1+, 19.1.2+, 19.2.1+ for RCE; 19.0.4+, 19.1.5+, 19.2.4+ for DoS fixes). Regular dependency audits are essential to stay ahead of known vulnerabilities.

5. The Taint API (taintObjectReference, taintUniqueValue): React’s experimental Taint API can serve as a valuable development-time guardrail. It registers objects or strings with the runtime, causing an error if tainted data attempts to pass through the Flight serializer. However, it tracks object references, not data content. Any derivation (spreading an object, accessing individual properties, JSON serialization round-trips) breaks the taint tracking. It helps catch accidental leaks by developers but is not a robust security boundary against determined attackers.

6. Web Application Firewalls (WAFs): WAFs can provide a detection layer for known attack patterns. Rules can block POST requests containing Next-Action headers with suspicious payloads like __proto__ or constructor:constructor. They can also flag E{"digest" patterns in text/x-component responses, indicating potential server-side error leakage. However, WAFs are easily bypassed by motivated attackers using padding, encoding tricks, or chunked transfer encoding to exceed inspection buffer limits. They are a valuable noise-reduction layer, but not a primary security control.

Persistent Exposures and the Road Ahead

Despite patches, certain structural risks remain inherent in the Flight protocol:

• Man-in-the-Middle (MITM) on the Flight Stream: If an attacker can intercept the plain-text Flight stream (e.g., via CDN compromise or rogue proxies), they could inject malicious $I (Import) rows to redirect component loading, embed hidden RPC triggers with $F (Server Reference) tags, or modify D (Data) rows to introduce XSS via dangerouslySetInnerHTML. The protocol’s $ escaping only protects data flowing through the serializer, not direct stream manipulation.
• Server Action Enumeration: Build-time generated server-reference-manifest.json files, if exposed (e.g., due to misconfigured hosting), can map obfuscated Server Action IDs back to their source implementations. This grants attackers a complete API map, facilitating IDOR (Insecure Direct Object Reference) and parameter tampering attacks.
• Encrypted Closure Tampering: Server Actions capturing variables from their scope are encrypted by Next.js using NEXT_SERVER_ACTIONS_ENCRYPTION_KEY. If an attacker gains file read access and extracts this key, they can decrypt, modify (e.g., change a userId or role), and re-encrypt the closure state, allowing the server to accept forged data as legitimate.
• Supply Chain Activation via Module IDs: An attacker might inject malicious $I import references into the Flight stream to activate dormant, compromised npm packages bundled into application chunks. This attack doesn’t require the package to be explicitly imported by the application code; merely its presence in the bundle output could be enough to trigger its loading and execution.

The React Flight protocol is a testament to ingenious engineering, solving complex challenges in streaming interactive component trees. Yet, its reliance on serializing executable references, async state, and module pointers over a streaming text protocol, with an implicit trust in its structure, has opened a Pandora’s Box of security challenges. The hasOwnProperty fix was correct, and subsequent DoS and information disclosure vulnerabilities have been addressed. However, the architectural decision to expose arbitrary property traversal and executable "Thenable" reconstruction through a network-facing protocol represents a fundamental design choice that demands continuous vigilance.

As more frameworks adopt server-driven UI patterns, the industry must evolve beyond the simple adage of "the server is trusted." The future necessitates stronger security primitives: cryptographic validation of serialized payloads, signed component trees, and robust content integrity checks on the Flight stream itself. Developers working with Server Components are urged to delve into the react-client/src/ReactFlightClient.js source code to understand the mechanisms their framework trusts on their behalf, recognizing that true security lies not just in patching known flaws, but in comprehending and hardening the underlying architectural foundations.