Skip to content
Emergency helpGet started
Back to Tools

React2Shell Scanner

Inspect React Server Components response signals on an authorized target. Results guide manual review and do not confirm a specific vulnerability or patch status.
Start a check
  • Email verification required
  1. 1Input
  2. 2Verify
  3. 3Scan
  4. 4Results
Step 1

Enter Target Details

Provide the URL to scan and your company email for verification. Your email domain must match the target domain to prevent unauthorized scanning.

The URL of the React/Next.js application to scan

Must match the domain being scanned (e.g., @example.com for example.com)

Loading security verification...

Educational Use Only:

This tool is provided for educational and authorized security testing purposes only. You must only scan applications that you own or have explicit written permission to test.

Misuse Warning: Unauthorized scanning of systems you do not own may violate computer fraud laws. Misuse of this tool may be reported to the appropriate authorities.

Your IP Address: ... is being logged for security purposes.

By proceeding, you confirm that you have authorization to scan the target application and consent to Vigilbase storing your information for security logging and future communications.

Introducing the Vigilbase Platform

The cybersecurity operating system.

Connect the security tools you already pay for. Spin up personalised dashboards in minutes, with every log and event auditable and queryable in one place.

Get startedExplore Managed Cloudflare
one.vigilbase.com/acme.examplePreview ยท sample data

Acme Security OS

3 sources connected

Ingesting
Cloudflare

Threats mitigated

0

AWS

Root & IAM changes

0

GitHub

Org security changes

0

events | where severity >= medium | last 24h
    Vigil agentWorking
    1. Investigate Credential-stuffing burst against /login
    2. Fix Rate-limit rule deployed at the edge
    3. Verify Attack traffic down 98% in five minutes

    About this vulnerability

    React2Shell (CVE-2025-55182, also tracked by the Next.js advisory CVE-2025-66478) is a critical remote code execution vulnerability in React Server Components. CVE-2025-55183 is a separate, medium-severity source-code exposure issue and does not allow remote code execution.

    View CVE Details

    How this scanner works

    This scanner sends detection requests and inspects RSC response patterns without executing malicious code. These signals need review and do not confirm exploitability. A negative result does not establish that every RSC vulnerability is patched. Verify installed versions against the official React and Next.js advisories.

    What is React2Shell?

    React2Shell is the name for CVE-2025-55182, a critical remote code execution vulnerability in React Server Components rated CVSS 10.0. Vulnerable versions unsafely deserialize payloads sent to Server Function endpoints, so an unauthenticated attacker can send a crafted HTTP request that runs code on the server. React and Next.js disclosed it on December 3, 2025, with patched releases available the same day.

    A React2Shell check looks for remote-code-execution exposure signals on React Server Components / Next.js surfaces. Vigilbase uses safe, non-exploitative probes and requires email verification because the scan is intrusive. Use it only on authorized targets.

    React2Shell at a glance

    Lachlan Davidson, who reported the flaw to Meta, documents it as React2Shell. The facts below come from the React, Next.js, GitHub and NVD advisories listed under Sources.
    CVE
    CVE-2025-55182
    Severity
    Critical, CVSS 10.0
    Type
    Unauthenticated remote code execution (CWE-502)
    Disclosed
    December 3, 2025

    Next.js first tracked the downstream impact as CVE-2025-66478. That CVE record was rejected as a duplicate of CVE-2025-55182, so both identifiers refer to the same flaw. CISA added CVE-2025-55182 to its Known Exploited Vulnerabilities catalog on December 5, 2025.

    Affected and fixed versions

    Upgrading is the fix. The Next.js advisory states that there is no workaround.

    React

    react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0 are affected. React fixed the vulnerability in 19.0.1, 19.1.2 and 19.2.1. Frameworks and bundlers built on these packages are affected too, including Next.js, React Router, Waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk.

    React later disclosed denial-of-service and source code exposure issues in the same packages (CVE-2025-55184, CVE-2025-67779, CVE-2025-55183 and CVE-2026-23864). They do not allow remote code execution, and the React2Shell patch remains effective, but React lists 19.0.4, 19.1.5 and 19.2.4 as the safe versions. Upgrade to the latest patched release in your line.

    Next.js

    Apps using React Server Components with the App Router are affected on Next.js 15.x, 16.x and 14.3.0-canary.77 or later canary releases. Next.js 13.x, Next.js 14.x stable, Pages Router applications and the Edge Runtime are not affected. On a 14.3 canary, downgrade to the latest stable 14.x release.

    Release lineFirst fixed version
    15.0.x15.0.5
    15.1.x15.1.9
    15.2.x15.2.6
    15.3.x15.3.6
    15.4.x15.4.8
    15.5.x15.5.7
    16.0.x16.0.7
    15.x canary15.6.0-canary.58
    16.x canary16.1.0-canary.12

    Next.js recommends rotating application secrets after patching, and strongly encourages it if the app was online and unpatched as of December 4, 2025 at 1:00 PM PT.

    Next.js also publishes an interactive tool that checks your version and applies the recommended upgrade:

    npx fix-react2shell-next

    Disclosure timeline

    1. November 29, 2025Lachlan Davidson reports the vulnerability to Meta through its bug bounty program.
    2. November 30, 2025Meta security researchers confirm the vulnerability.
    3. December 1, 2025A fix is created and the React team starts coordinating with hosting providers and open source projects.
    4. December 3, 2025Patched React packages are published to npm and the issue is disclosed as CVE-2025-55182. Next.js publishes its advisory the same day.
    5. December 5, 2025CISA adds CVE-2025-55182 to its Known Exploited Vulnerabilities catalog.
    6. December 6, 2025Next.js releases the npx fix-react2shell-next upgrade tool and advises rotating secrets for apps that were online and unpatched as of December 4, 2025 at 1:00 PM PT.
    7. December 11, 2025React discloses follow-up denial-of-service (CVE-2025-55184, CVE-2025-67779) and source code exposure (CVE-2025-55183) issues in the same packages.
    8. January 26, 2026React discloses a further denial-of-service issue, CVE-2026-23864, and states that versions 19.0.4, 19.1.5 and 19.2.4 are safe.

    Sources

    Questions

    React2Shell FAQ

    What is React2Shell?

    React2Shell is CVE-2025-55182, a critical (CVSS 10.0) unauthenticated remote code execution vulnerability in React Server Components, disclosed on December 3, 2025. Vulnerable versions unsafely deserialize payloads sent to Server Function endpoints, which can let an attacker run code on the server.It affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack 19.0.0, 19.1.0, 19.1.1 and 19.2.0, and frameworks built on them, including Next.js with the App Router.

    Which React and Next.js versions fix React2Shell?

    React fixed the vulnerability in 19.0.1, 19.1.2 and 19.2.1. Next.js fixed it in 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7 and 16.0.7. Later React advisories for related denial-of-service and source code exposure issues require 19.0.4, 19.1.5 or 19.2.4, so upgrade to the latest patched release in your line.Next.js 13.x, Next.js 14.x stable, Pages Router applications and the Edge Runtime are not affected. Next.js says there is no workaround: upgrading is required.

    What is the difference between CVE-2025-55182 and CVE-2025-66478?

    CVE-2025-55182 is the React vulnerability. Next.js published CVE-2025-66478 to track the impact on Next.js apps, but the CVE record was rejected on December 3, 2025 as a duplicate of CVE-2025-55182. Both identifiers refer to the same React2Shell flaw.

    What is the React2Shell Scanner?

    It is a Vigilbase tool that probes an authorized public URL for React Server Components response signals. Results guide manual assessment; ordinary protocol responses do not confirm a CVE or exploitability.Treat a reported signal as evidence to investigate with the application owner. Confirm the deployed framework and affected version before selecting a remediation, then verify the updated application.Tool access and verification requirementsWebsite Security Check

    Is React2Shell scanning intrusive?

    Yes. Unlike DNS or header checks, React2Shell sends probes to the target application. Only scan systems you own or are explicitly authorized to test. Email verification is required before a scan runs.Receiving a verification code is not proof that you own the target or have permission to test it. Confirm authorization and the intended target before sending application probes.Tool access and verification requirementsHTTP Security Headers Checker

    Can agents run React2Shell autonomously via API?

    No. Intrusive scanners stay browser-gated. Autonomous agents should use the non-intrusive Security Headers or Email Security APIs instead, then point operators to the React2Shell UI when an authorized probe is needed.Run a check through the public APITool access and verification requirements

    Is the React2Shell Scanner free?

    Yes. The public scanner is free after email verification. No Vigilbase account is required to run a check.Free access does not remove the authorization requirement. Results are limited to the probe behavior observed and should not be treated as a complete application security assessment.Compare the public security checksTool access and verification requirements