CVE-2025-55182 (also referred to as React2Shell and includes CVE-2025-66478, which was merged into it) is a critical pre-authentication remote code execution (RCE) vulnerability affecting React Server Components, Next.js, and related frameworks. With a CVSS score of 10.0, this vulnerability could allow attackers to execute arbitrary code on vulnerable servers through a single malicious HTTP…
Defending against the CVE-2025-55182 (React2Shell) vulnerability in React Server Components
calendar_today
December 15, 2025
person
Microsoft Defender Security Research Team
domain
microsoft-defender-for-cloud