Loading vulnerability…
React2Shell
React2Shell is a pre-authentication remote code execution vulnerability in React Server Components caused by unsafe deserialization of attacker-controlled HTTP request payloads in Server Function request handling through the React Flight protocol. It affects react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including affected framework integrations such as Next.js App Router. Crafted requests can cause arbitrary server-side code execution without authentication or user interaction. The vulnerability was publicly disclosed on December 3, 2025, and has been exploited in the wild. It is distinct from the October 2026 React Flight protocol-framing vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the application server within the privileges and resource access available to the application process, potentially affecting confidentiality, integrity, and availability. Observed post-exploitation activity includes credential and SSH-key theft, backdoor installation, and cryptocurrency mining. Access to application secrets and connected resources can facilitate additional compromise; elevated operating-system privileges are not inherently guaranteed.
If you can’t patch tonight, do this now.
Until patching is complete, restrict access to vulnerable server endpoints to trusted sources or enforce authentication at a reverse proxy, and disable unnecessary externally reachable functionality. Apply vendor-provided WAF protections as defense in depth rather than a substitute for updates. AWS deployments can use AWSManagedRulesKnownBadInputsRuleSet version 1.24 or an appropriate later version, or test and deploy the bulletin's custom blocking rule. Rotate exposed SSH keys, API tokens, and database credentials after securing affected applications.
Patch, then assume compromise.
Upgrade affected React Server Components packages to 19.0.1, 19.1.2, or 19.2.1, as appropriate, or a later supported patched release. For affected Next.js deployments, update Next.js itself to an applicable fixed release: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, or 16.0.7; patched canary releases include 15.6.0-canary.58 and 16.1.0-canary.12 or later. Update affected Cal.com deployments to 5.9.9 or later. Rebuild and redeploy applications with patched dependencies, including framework-bundled runtimes. For compromised deployments, rotate exposed secrets alongside remediation and investigate persistence and subsequent credential misuse.
307 exploits validated by Mallory's analysis. Hidden: 170 rejected by Mallory's analysis as not a working exploit; 23 not yet analyzed, such as Exploit-DB entries; 116 not loaded here. Showing the 25 most capable, earliest first.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1,685 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.