More than 50 million websites run on React.js. Created by Meta in 2011, it became the dominant frontend library by practice, which means any failure in its server-side model turns into a supply shock for web stacks of every shape. On December 3, 2025, a flaw in React Server Components affecting versions 19.0.0 through 19.2.0 was disclosed: React2Shell. Crafted requests impersonated internal server actions and reached the RSC deserializer. By abusing trusted serialization fields, attacker input was treated as executable JavaScript. With code running in the server context, Node.js internals were exposed, enabling full remote code execution. Impact rippled beyond React into its ecosystem, including Next.js and, worse, React Native used to build mobile apps. React Native uses the phone as a kind of server, so the exploit provided access to it. So far there are more than 100K reported cases of servers being vulnerable. Many systems broke, many are still recovering, and some remain unfixed or unaware. We were hit too. React is a core technology in our stack. A few systems were attacked, mostly unsuccessfully. A patched release landed almost instantly; updating was straightforward. The hard part was the aftermath: identifying what was touched, removing consequences where we could prove them, and, where we couldn’t, choosing safety over certainty by redeploying affected platforms with minimal downtime. Exposure clustered where we used React Server Components or server actions. We upgraded to the patched React 19 release immediately, then the hardest part came - cleanup, we treated it as a production change, not a postscript. In projects where we observed consequences of probing or exploitation, we removed them; where uncertainty persisted, we redeployed from known-good artifacts. Kubernetes and CI/CD let us roll updates with controlled impact - replace containers, drain traffic, verify health, proceed-so we could reset suspect state without extended outages.
So how you can handle it:
- If you’re on React 19.0.0-19.2.0, update to the patched React 19 release immediately, including frameworks like Next.js and any React Native code paths involved.
- Inventory where you use React Server Components or server actions; prioritize anything that deserializes data on the server over purely client-rendered frontends.
- If compromise can’t be ruled out, redeploy from clean images and known-good artifacts; use rolling updates to minimize downtime while resetting uncertain state.
- Review logs for requests that imitate internal server actions hitting deserialization paths; treat positives as an incident, not noise.
React2Shell: the React 19 deserialization bug, its blast radius, and how we handled it
F
Formamind team
On Dec 3, 2025, React2Shell landed. A flaw in React 19 Server Components let crafted requests run server-side JavaScript. Next.js and React Native were hit. We patched fast, then had to clean up smarter.
