Remote code execution vulnerability in React Server Components

What happened

A vulnerability in the way React handles server components allows unauthenticated users to execute commands on your server. This flaw, often called React2Shell, bypasses standard security checks because of how it processes incoming data. Reports of active exploitation followed within days of the advisory.

Who is affected

You are at risk if you use React 19 or frameworks like Next.js that implement React Server Components. This includes projects using the App Router or experimental RSC features. If your application is accessible from the internet, assume it is vulnerable until you apply the patch.

Why it matters if you build with AI

AI tools often generate code using the latest React features and the App Router. These generated projects may include vulnerable versions of React and Next.js. You must check the package files of any AI-generated application to ensure they use fixed versions.

What to do

• Update React to version 19.0.1, 19.1.2, or 19.2.1
• Upgrade Next.js or your framework to the latest patched release
• Rotate all environment variables and secrets if your site was public
• Verify that your deployment pipeline uses these specific versions

Sources

• react.dev
• cisa.gov