Navigation
VigilbaseDocs

    Type at least two letters.

    Open Vigilbase One

    React2Shell

    Look for React Server Components exposure signals linked to CVE-2025-55182 on a site you own, and read what each result means.

    View as Markdown
    On this page
    1. Why you verify your email first
    2. Run a scan
    3. How the scan works
    4. What each result means
    5. Fix it
    6. Also in Website Security

    The React2Shell Scanner sends detection requests to a React or Next.js site and looks for React Server Components (RSC) response signals linked to CVE-2025-55182, the critical unauthenticated remote code execution issue disclosed on December 3, 2025. Run it at vigilbase.com/tools/react2shell.

    Why you verify your email first

    The scan is intrusive, so you verify a work email before it runs, and the email domain must match the site's domain. Personal and free mailbox providers are refused. Verification confirms you can read the mailbox; it does not give you permission to test the site.

    Run a scan

    1. Enter the URL and your work email.

    2. Complete the security check and request the code.

    3. Enter the 6-digit code from the email. The scan runs and shows its progress.

    4. Read the result. It is also emailed to you with a link to the saved run.

    How the scan works

    The scanner sends two detection requests to the URL, each shaped like a React Server Action call:

    1. A multipart/form-data request.
    2. An application/x-www-form-urlencoded variant.

    It reads the status, content type and the first part of each response body for RSC Flight protocol signals and server error digests. It does not run code on the target.

    What each result means

    The scanner gives a status, not a letter grade.

    ResultMeaningWhat to do
    Manual Review RequiredThe responses showed RSC signals that need a person to look at them. An ordinary Flight response or a server error digest does not confirm remote code execution or source code exposure.Check the installed React and Next.js versions against the official advisories.
    No Vulnerability Indicators DetectedNo RSC indicators were found. The site may not use React Server Components, or may not be a React app.This does not prove every RSC issue is patched; keep your versions current.
    Scan Could Not CompleteThe scan could not finish, for example because the site timed out or refused the requests.Check the URL and try again.

    Fix it

    Upgrade React and Next.js to a patched release. For Next.js, the advisory for CVE-2025-66478 lists these first fixed versions:

    Release lineFixed in
    15.0.x15.0.5
    15.1.x15.1.9
    15.2.x15.2.6
    15.3.x15.3.6
    15.4.x15.4.8
    15.5.x15.5.7
    16.0.x16.0.7
    15.x canary15.6.0-canary.58
    16.x canary16.1.0-canary.12

    Later React advisories added denial-of-service and source code exposure fixes in the same packages; React states that 19.0.4, 19.1.5 and 19.2.4 are safe. Next.js also advises rotating secrets for apps that were online and unpatched as of December 4, 2025 at 1:00 PM PT.

    Sources: the React blog post "Critical Security Vulnerability in React Server Components", the Next.js advisory for CVE-2025-66478 and NVD entry CVE-2025-55182.

    Also in Website Security

    Website Security includes the React2Shell signals among its 27 checks. From the CLI, the scanner runs through Vigilbase One and needs a sign-in:

    Bash
    vigilbase login
vigilbase run react2shell https://example.com