POC-CVE-2025-55182

NoMoreBreach Advisory: React2Shell CVE-2025-55182 Severity: Critical CVSS 10.0 Vulnerability Type: Remote Code Execution RCE via Deserialization Status: Patched Dec 3, 2025 Advisory Source: NoMoreBreach.com Executive Summary The NoMoreBreach research team highlights a critical vulnerability in...

CVE-2025-55182

React2Shell Vulnerability - CVE-2025-55182 📓 Introduction This vulnerability, known as React2Shell, was discovered in December 2025 and affects components of next.js with CVSS 10.0. With a simple POST request, it's possible to obtain an critical unauthenticated RCE. Below are the versions affecte...

react2shell-rce-autobot

🔍 React2Shell Dork Scanner 🚨 About the Vulnerability React2Shell is a critical Remote Code Execution RCE vulnerability that affects: Target| Versi Vulnerable ---|--- ⚛️ react-server-dom-webpack| 19.0.0, 19.1.0, 19.1.1, 19.2.0 ⚛️ react-server-dom-turbopack| 19.0.0, 19.1.0, 19.1.1, 19.2.0 ⚛️...

Next.js-RSC-RCE-Scanner-Burp-Suite-Extension

Next.js RSC RCE Scanner Burp Suite Extension A high-fidelity Burp Suite extension to detect the Next.js / React Server Components RSC Remote Code Execution vulnerability CVE-2025-55182 & CVE-2025-66478. This extension implements the detection logic discovered by the Searchlight Cyber Security...

cve-2025-55182-lab

CVE-2025-55182 - React2Shell Lab Overview CVE-2025-55182 React2Shell is a CVSS 10.0 critical Unauthenticated Remote Code Execution RCE vulnerability in React Server Components RSC's Flight Protocol, affecting react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack packages...

CVE-2025-55182-React2Shell-Async-Scanner

⚡ React2Shell CVE-2025-55182 / CVE-2025-66478 - Async RCE Scanner Prototype-pollution → Remote Code Execution via React Server Actions Async, version-first, output-based canary detection - no blind guessing !WARNING For authorised security research and penetration testing only. Scanning systems...

CLSA-2026-1792251863 TuxCare security update for react-server-dom-parcel (4 CVEs)

TuxCare rebuilt react-server-dom-parcel to address 4 CVEs. Fixed in 19.2.0-tuxcare.7...

CLSA-2026-1792251862 TuxCare security update for react-server-dom-parcel (1 CVE)

TuxCare rebuilt react-server-dom-parcel to address 1 CVE. Fixed in 19.2.0-tuxcare.6...

PT-2026-127086

TuxCare rebuilt react-server-dom-parcel to address 4 CVEs. Fixed in 19.2.0-tuxcare.7...

PT-2026-127085

TuxCare rebuilt react-server-dom-parcel to address 1 CVE. Fixed in 19.2.0-tuxcare.6...

CLSA-2026-1792161658 TuxCare security update for react-server-dom-webpack (4 CVEs)

TuxCare rebuilt react-server-dom-webpack to address 4 CVEs. Fixed in 19.2.0-tuxcare.7...

CLSA-2026-1792161657 TuxCare security update for react-server-dom-webpack (1 CVE)

TuxCare rebuilt react-server-dom-webpack to address 1 CVE. Fixed in 19.2.0-tuxcare.6...

CLSA-2026-1792161643 TuxCare security update for react-server-dom-turbopack (4 CVEs)

TuxCare rebuilt react-server-dom-turbopack to address 4 CVEs. Fixed in 19.2.0-tuxcare.7...

CLSA-2026-1792161642 TuxCare security update for react-server-dom-turbopack (1 CVE)

TuxCare rebuilt react-server-dom-turbopack to address 1 CVE. Fixed in 19.2.0-tuxcare.6...

PT-2026-124198

TuxCare rebuilt react-server-dom-turbopack to address 4 CVEs. Fixed in 19.2.0-tuxcare.7...

PT-2026-124197

TuxCare rebuilt react-server-dom-turbopack to address 1 CVE. Fixed in 19.2.0-tuxcare.6...

PT-2026-124211

TuxCare rebuilt react-server-dom-webpack to address 4 CVEs. Fixed in 19.2.0-tuxcare.7...

PT-2026-124210

TuxCare rebuilt react-server-dom-webpack to address 1 CVE. Fixed in 19.2.0-tuxcare.6...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +51 more potentially affected by unknown CVE via react-server-dom-webpack (>=19.0.0-canary-36e62c603-20240418, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0-canary-36e62c603-20240418, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245...

@cedarjs/api-server-watch (>=6.0.3-next.227, <=8.0.0-canary.3460), @cedarjs/cli (>=6.0.3-next.227, <=8.0.0-canary.3460) +10 more potentially affected by unknown CVE via react-server-dom-webpack (19.3.0)

react-server-dom-webpack NPM version 19.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @cedarjs/api-server-watch =6.0.3-next.227, =6.0.3-next.227, =6.0.3-next.227, =6.0.3-next.227, =6.0.3-next.227,...