A newly disclosed flaw in React Server Components (RSC) and the frameworks built upon them—most notably Next.js—has exposed a massive attack surface across the modern web. Tracked as CVE-2025-55182 (React) and CVE-2025-66478 (Next.js), this vulnerability allows attackers to execute arbitrary code on vulnerable servers without authentication.

While the immediate threat is Remote Code Execution (RCE), the strategic risk is the exposure of backend cloud resources. Because these frameworks dominate modern cloud deployments, this flaw effectively converts web servers into open gateways for compromising connected cloud storage, data lakes, and internal infrastructure

The Mechanism: Unsafe Serialization

The issue stems from unsafe handling of serialized payloads within the RSC “Flight” protocol. Because React Server Functions automatically deserialize and trust certain data structures, an adversary can smuggle executable instructions directly into the request flow.

Attackers exploit this via three primary pathways:

1. Direct exploitation via crafted RSC requests
   • Sending crafted “Flight” protocol payloads to RSC endpoints, causing the server to mistake attacker values for legitimate function references.
2. Indirect exploitation through user-triggered actions
   • Using malicious scripts to trigger vulnerable endpoints through standard user interactions (e.g., fetch calls), enabling attacks without user awareness.
3. Framework-level amplification (Next.js, others)
   • Since Next.js automatically exposes server function handlers, even unmodified, default boilerplate applications inherit these exploitable surfaces.

The Cloud Impact: From RCE to Data Breach

The vulnerability, dubbed React2Shell, has scored a CVSS 10.0 (maximum severity). The critical danger lies in the relationship between the compromised web server and the cloud environment it inhabits.

1. Identity Theft and IAM Role Pivoting: Modern React and Next.js applications often run with over-privileged IAM roles to facilitate seamless interaction with cloud services. Once an attacker achieves code execution, they inherit the identity of that server. This allows them to pivot across cloud infrastructure, accessing any resource the web server is authorized to touch.
2. Compromise of Cloud Storage and Secrets: The vulnerability enables the immediate exfiltration of environment variables and secrets. In cloud-native architectures, these variables frequently contain access keys and secret keys for:
   • Object Storage (S3, Blob, GCS): Attackers can list, download, or delete massive datasets.
   • Internal APIs: Granting access to private microservices or databases.
3. Persistent Threats and Exfiltration: Attackers can utilize the compromised server to establish outbound connections, siphoning data to unknown IP addresses. Furthermore, by leveraging the server’s write permissions, adversaries can execute arbitrary system commands to plant malware or ransomware within connected storage buckets, potentially poisoning the application’s supply chain.

Indicators of Compromise – Signs to Monitor

Organizations running React or Next.js workloads must monitor for signs of active exploitation, which can occur in milliseconds. Key indicators include:

• Unexpected POST requests to RSC endpoints (_rsc, react, server function routes).
• Anomalous payloads containing suspicious serialized references or unusual symbols.
• Unexpected outbound traffic from app servers to unknown IPs, indicating potential data exfiltration from local storage or cloud buckets.
• Sudden spikes in 500-level responses during exploit probing.

Even short-lived anomalies warrant investigation, as exploit attempts can occur in milliseconds.

Response and Remediation

1. Patch: Upgrade React RSC (19.0.1 / 19.1.2 / 19.2.1+) and latest Next.js. 
2. Isolate: Quarantine systems receiving suspicious RSC traffic to prevent lateral movement.
3. Audit Logs: Review logs for process spawns or unauthorized outbound connections.
4. Rotate All Secrets: Assume environment variables and cloud credentials have been compromised. Rotate all secrets, specifically those granting access to cloud storage and internal APIs.

Implement runtime protection and strict input validation for all serialized data. Furthermore, adopt a rigorous “least privilege” model for IAM roles to ensure that a compromised web server does not automatically grant total access to the organization’s cloud data layer.

Conclusion

React2Shell is not a niche bug; it is a catastrophic flaw affecting up to 40% of cloud-hosted web apps. Attackers require only one overlooked assumption to compromise entire platforms. Organizations must urgently patch and harden their deployments to prevent their web servers from becoming the entry point for a full-scale cloud data breach.