Inside React2Shell

📰 Dev.to · Mehmet Aras

CVE-2025-55182, the React Server Components RCE. A missing Chunk validation in the Flight protocol let one HTTP request run arbitrary code on default Next.js projects.

Published 24 Apr 2026