Anatomy of a CVSS 10.0 Threat: Weaponizing and Defending the React Flight Protocol

When React Server Components (RSCs) were first introduced, they promised to change how developers think about data fetching and rendering. Instead of sending raw JSON or pre-rendered HTML down the wire, modern React architectures rely on a custom, streaming protocol called Flight. Designed to handle complex, asynchronous component trees, module imports, and server actions, Flight is a marvel of framework engineering.

However, beneath its streamlined surface lies a massive structural attack surface. Security researchers, notably vulnerability analyst Durgesh Pawar, have demonstrated that the very mechanics enabling Flight to reconstruct executable behavior on the client can be leveraged by attackers to achieve remote code execution (RCE).

This structural vulnerability materialized in December 2025 as CVE-2025-55182—widely known as "React2Shell." Boasting a maximum CVSS score of 10.0, this unauthenticated vulnerability allowed malicious actors to compromise servers with a single crafted HTTP request. This report breaks down the mechanics of the React2Shell vulnerability, details the chronology of its exploitation, analyzes supporting data from security vendors, highlights official responses, and outlines a ranked set of practical defenses to secure modern React applications.

Main Facts: What is the Flight Protocol and React2Shell?

To understand how React2Shell works, one must first understand what travels over the network on a modern Next.js App Router page. When an RSC renders, the server does not send an HTML document or a traditional JSON object. Instead, it streams a line-delimited text format known as Flight.

Every row in a Flight payload follows a strict syntax (<ROW_ID>:<ROW_TAG><PAYLOAD>n), containing structural metadata, import directives, and virtual DOM fragments. Crucially, Flight also utilizes a prefix system denoted by the dollar sign ($). When the client-side parser encounters strings starting with $, it routes them through type-specific resolution paths:

• $F creates callable server references (RPC endpoints).
• $L establishes lazy-loaded component boundaries.
• $@ exposes internal framework chunks and promises.
• $: handles arbitrary property access across resolved objects.

Flight is not merely a data serialization format; it is a deserialization system that reconstructs executable behavior.

The React2Shell vulnerability (CVE-2025-55182) exploits this behavior in the server-side reply handling logic (ReactFlightReplyServer.js). Specifically, the getOutlinedModel function resolves colon-separated property paths (such as $1:user:name) without verifying whether properties exist on the object itself or walking up the shared prototype chain.

An attacker supplying a payload containing $1:__proto__:constructor:constructor forces the parser to traverse from a plain JSON object up through Object.prototype to the global Function constructor. In JavaScript, the Function constructor behaves identically to eval(), allowing arbitrary remote code execution without requiring user authentication or credentials.

Chronology of Disclosures and Exploitations

The timeline surrounding the React2Shell vulnerability and its subsequent patches highlights an intensely active threat landscape:

• Early December 2025: CVE-2025-55182 (React2Shell) is publicly disclosed as a CVSS 10.0 unauthenticated RCE vulnerability in the React Flight deserialization layer.
• Within Hours of Disclosure: In-the-wild exploitation begins. Threat intelligence firms like Sysdig track attacks linked to state-sponsored actors.
• Mid-December 2025: The React team releases emergency patches in React versions 19.0.1, 19.1.2, and 19.2.1, caching hasOwnProperty.call() to block prototype traversal gadget chains. Concurrently, related Denial of Service (DoS) and information disclosure CVEs emerge (CVE-2025-55184, CVE-2025-67779, CVE-2025-55183).
• January 2026: Additional attack vectors are discovered, including CVE-2026-23864 (unbounded request body buffering causing memory exhaustion) and CVE-2026-27978 (a cross-site request forgery bypass affecting Next.js 16.1.7 via sandboxed Origin: null headers).
• Ongoing (2026): Cybersecurity authorities globally continue to catalog exploits as malicious campaigns weaponize deserialization flaws.

Supporting Data: In-the-Wild Threats and Automated Attacks

The severity of React2Shell was underscored by its rapid weaponization by sophisticated threat actors.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) swiftly added CVE-2025-55182 to its Known Exploited Vulnerabilities (KEV) catalog, mandating immediate remediation across federal civilian agencies. Meanwhile, private security researchers documented advanced post-exploitation frameworks:

1. EtherRAT Operations: Security firm Sysdig published telemetry tying initial React2Shell exploitation waves to North Korean state-sponsored actors. These actors deployed file-less implants communicating via the Ethereum blockchain—a stealthy command-and-control method often dubbed "EtherHiding" that resists traditional domain takedowns.
2. KSwapDoor Backdoors: Unit 42 researchers at Palo Alto Networks uncovered a custom Linux backdoor named KSwapDoor. Designed to masquerade as the legitimate kernel swap daemon process ([kswapd1]), KSwapDoor protects its internal configurations with RC4 encryption while utilizing AES-256-CFB and Diffie-Hellman key exchanges across a peer-to-peer mesh network for C2 communications.
3. The DoS and Info-Leak Cascade: Following the primary RCE patch, subsequent CVEs demonstrated that deserialization parsers are notoriously difficult to harden completely. Infinite recursion vulnerabilities (CVE-2025-55184 and CVE-2025-67779) were found to exhaust Node.js CPU event loops, while source-code exposure bugs (CVE-2025-55183) inadvertently reflected backend business logic when server functions implicitly stringified arguments.

Official Responses from Framework Maintainers

The React core team and downstream framework maintainers (such as Vercel for Next.js) responded aggressively to the crisis.

The primary fix for CVE-2025-55182 involved a targeted hardening of object property checks. By caching the genuine hasOwnProperty method at module load time (var hasOwnProperty = Object.prototype.hasOwnProperty;) and enforcing its usage via .call() across the deserialization path (hasOwnProperty.call(value, i);), the framework successfully neutralized the prototype-chain gadget used in the original exploit.

However, security auditors have noted that these patches are largely reactive band-aids. While the specific gadget chain for React2Shell was closed, the underlying architecture—which allows a streaming network protocol to instantiate executable references, lazy components, and complex object graphs—remains fundamentally unchanged.

Framework maintainers have continually urged developers to upgrade to the latest minor and patch releases (React 19.0.4+, 19.1.5+, 19.2.4+ and Next.js 16.1.7+) to mitigate the secondary DoS and CSRF vectors that followed the initial disclosure.

Implications: Securing React Applications Against Structural Risks

Because framework patches cannot completely eliminate the inherent risks of parsing complex streaming protocols, development teams must implement robust, defense-in-depth security measures at the application level.

Based on threat research and vulnerability analysis, defenses can be ranked by their practical impact:

1. Strict Input Validation on Server Actions (Zod, Valibot)

Because the Flight deserializer processes raw, unvalidated network input before application code takes control, strict schema validation is your primary line of defense.

• Place validation schemas (using libraries like Zod or Valibot) at the absolute top of every Server Action, prior to any logging or business logic execution.
• Always validate raw composite arguments rather than destructuring fields beforehand, as early property access can trigger vulnerabilities on unvalidated inputs.

2. Isolate Sensitive Logic with the server-only Package

Import server-only at the top of any file containing database connections, internal API credentials, or sensitive business logic. This guarantees that any accidental import into a Client Component triggers an immediate build failure. Avoid mixing server and client code inside un-namespaced barrel (index.ts) files.

3. Comprehensive CSRF Hardening

Never rely solely on default framework configurations for state-changing operations.

• Explicitly set strict cookie policies (SameSite=Strict or SameSite=Lax).
• Implement explicit, per-session CSRF tokens for high-value actions (such as credential updates or financial transactions).
• Crucially: Never add 'null' to experimental.serverActions.allowedOrigins in your Next.js configuration, as this explicitly reopens the CVE-2026-27978 CSRF bypass vector for sandboxed iframes.

4. Leverage the React Taint API Wisely

While functions like taintObjectReference and taintUniqueValue serve as excellent development-time guardrails to prevent sensitive objects from leaking across the network boundary, remember that they track object references rather than data content. Routine data transformations or object destructuring will strip the taint, meaning it must be treated as defense-in-depth rather than an impenetrable security perimeter.

Conclusion

The discovery of React2Shell and its subsequent CVE cascade serve as a powerful reminder of historical security lessons. Much like Java’s ObjectInputStream, Python’s pickle, or ASP.NET’s ViewState, React Flight proves that whenever a framework invents a custom wire format to stream rich, stateful, and executable data between server and client, security challenges will inevitably follow.

Hoping that an upstream parser will catch every edge case is a losing battle. As server-driven UI architectures continue to proliferate across modern web development, the industry must move beyond the assumption of total trust in server-parsed streams—demanding stronger cryptographic validation, signed component trees, and vigilant application-layer validation to secure the future of the web.