Meta Releases Patch for React2Shell RCE Vulnerability (CVE‑2025‑55182)
Patch React to the latest version (≥18.2.0) immediately to eliminate the Flight protocol RCE.
Patch React to the latest version, test Flight endpoints for unsafe prototype references, and monitor logs for unexpected function calls.
Summary
On November 30 2025, Lachlan Davidson reported a critical remote code execution vulnerability in React's Flight protocol, dubbed React2Shell. The flaw, assigned CVE‑2025‑55182, allows attackers to execute arbitrary code on any server that processes Flight messages. Meta responded on December 3 2025 with a public advisory and a patch that removes the unsafe prototype reference check. The vulnerability affects millions of websites that use Next.js or other React Server Components, including many WordPress Gutenberg editors. The issue stems from Flight's ability to reference inherited properties, such as Number.prototype.toString, without validation. Attackers can craft Flight payloads that inject malicious functions, leading to code execution on the server. Meta urged developers to upgrade React to the patched version immediately. The incident highlights the need for runtime type checks in frameworks that accept complex data structures.
The fix removes the prototype lookup and enforces strict property validation for all Flight messages. Developers should verify that their applications do not expose untrusted Flight endpoints and should test for unexpected function references. The advisory includes a detailed example of a malicious Flight payload that triggers the vulnerability. Meta’s patch is available in the React 18.2.0 release and later. The vulnerability was discovered by a professional hacker who was originally investigating the Flight protocol. The advisory stresses that the flaw is not limited to Next.js but applies to any React application that uses Server Functions or Server Actions. The incident underscores the importance of secure deserialization practices in modern JavaScript frameworks.
Key changes
- CVE‑2025‑55182 is a remote code execution flaw in React's Flight protocol.
- The vulnerability allows attackers to reference inherited properties like Number.prototype.toString via Flight messages.
- Meta released a patch on December 3 2025 that removes unsafe prototype lookups and adds strict property validation.
- The fix is included in React 18.2.0 and later releases.
- The flaw affects any React app using Server Functions or Server Actions, including WordPress Gutenberg editors.
- Attackers can craft malicious Flight payloads that inject arbitrary functions, leading to code execution on the server.
- Meta’s advisory includes example payloads and recommends upgrading immediately.
- The incident highlights the need for runtime type checks when deserializing complex data structures.