Other nomination
React2Shell: JavaScript's Long-Awaited Deserialization Flight-mare (CVE-2025-55182)
The finder's page for React2Shell, an unauthenticated remote code execution flaw in server-side React reached through Server Component endpoints and tracked separately for Next.js because Next.js vendors React. It gives the disclosure timeline, links the original proof of concept, and warns that most circulating exploits and scanner results are invalid.
Record
- Researcher
- Lachlan Davidson
In the archive
Related sources
- Slides
- PoC
- Advisory
- Next.js security advisory
- React security advisory
- Follow-up: denial of service and source exposure
- Expo mitigation guidance
- Waku migration guidance
Tags
This page is the archive's own catalogue record. The research is the work of Lachlan Davidson, first published at the original source. Preserved copies are kept so the citation survives its host.