React2Shell Vulnerabilities - How Adversaries Exploit These Critical Flaws

In December 2025, a serious security vulnerability named Reach2Shell was disclosed, shaking the web development ecosystem. This vulnerability affects applications using React Server Components and the Flight protocol, allowing threat actors to execute arbitrary code on the server with a single HTTP request. It has been assigned a Common Vulnerability Scoring System (CVSS) score of 10.0 (Critical), and its impact is significant as it can be exploited without authentication.

This report will examine the background and attack flow of React2Shell (CVE-2025-55182), which involves exploiting deserialization during the Flight processing stage of React Server Components. It will also cover the countermeasures to this vulnerability.

▶ Download Report