CVE coverage
View on NVD →
CVE-2025-55182
CVSS 10.0
Actively exploited (KEV)
8 detections found
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Windows Suspicious React or Next.js Child Process | production | 2026-10-09 |
| elastic | Suspicious React Server Child Process | production | 2026-10-09 |
| elastic | React2Shell (CVE-2025-55182) Exploitation Attempt | production | 2026-09-18 |
| elastic | React2Shell Network Security Alert | production | 2026-09-18 |
| splunk | Linux Suspicious React or Next.js Child Process | production | 2026-05-13 |
| splunk | Cisco Secure Firewall - React Server Components RCE Attempt | production | 2026-05-13 |
| sigma | Linux Suspicious Child Process from Node.js - React2Shell | experimental | 2025-12-05 |
| sigma | Windows Suspicious Child Process from Node.js - React2Shell | experimental | 2025-12-05 |