Critical React Vulnerability 'React2Shell' Threatens Millions of Websites

Critical React2Shell vulnerability (CVE-2025-55182) affects millions, allowing code execution; patches available now.

Dec 5, 2025

ON THIS PAGE

Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our privacy policy.

A critical vulnerability dubbed React2Shell (CVE-2025-55182) has been discovered in React, the popular JavaScript library powering millions of websites including Airbnb, Instagram, and Netflix. The flaw allows remote attackers to execute code without authentication and affects React versions 19.0 through 19.2.0.

Patches are available in versions 19.0.1, 19.1.2, and 19.2.1. The vulnerability impacts applications using React Server Components, even if they don't implement Server Function endpoints. Security researchers warn that 39% of cloud environments contain vulnerable React instances, with over 968,000 servers potentially at risk.

Major cloud providers including Google, AWS, and Cloudflare have deployed protective measures, while cybersecurity experts expect widespread exploitation attempts soon.

Source: SecurityWeek

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo