React Server Components allow code execution (React2Shell)
Scan rule · RSC-SEC-155
- Security
- Severity: Critical
- CWE-502
- OWASP A06-2021
Combines the installed Next.js or React RSC version from the lock file (CVE-2025-66478 / CVE-2025-55182) with the context in the repository: App Router or Pages Router only, static export, hosting on a platform with a filter.
Why this matters
“React2Shell” is a deserialisation flaw in the React Server Components protocol: a single crafted request without login is enough to run code on the server — with access to every key in its environment variables. Every App Router app on an affected version is vulnerable, even without its own Server Actions.
The Pages Router does not use this protocol, and a static export has no server. Platforms such as Vercel filter known attack patterns — but a filter is not a patch. The rule therefore names version, router and hosting in the evidence and grades accordingly.
Check it yourself: the Next.js version is in the lock file; an `app/` folder with `page.tsx` or `layout.tsx` indicates the App Router. After the update, rotate the server keys if the app was publicly reachable with the affected version.
Scan tier
- Repo access (deep scan)
How to fix it
Raise Next.js to 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7 or 16.0.7 or newer (React RSC packages to 19.0.1, 19.1.2 or 19.2.1) and rotate the server keys if the affected version was publicly reachable.