Introduction
On November 30, 2025, Lachlan Davidson reported a critical remote code execution (RCE) vulnerability known as "React2Shell" to Meta. Within just three days, Meta released a fix and public advisory (CVE-2025-55182), urging developers to update immediately. This discovery was not premeditated. Davidson was merely trying to understand a protocol better to enhance his skills in hacking modern web applications. This endeavor led him to uncover a vulnerability affecting millions of websites.
The Background
Davidson, a professional hacker, frequently tested web apps built on Next.js, a widely used framework based on React. Next.js utilizes React Server Components (RSC) and React Server Functions to efficiently render server-side content and send it to users' browsers. These interactions require a specific request format that existing technologies couldn't adequately handle, prompting the React team to develop a new protocol.
The Discovery
On Monday, November 24, 2025, what started as an ordinary workday for Davidson took an unexpected turn. Driven by curiosity, he delved into analyzing this unusual request format. Like many others in the industry, he had previously treated this format as JSON with some added quirks. However, he decided to dig deeper.
The Significance of React2Shell
The React2Shell vulnerability exposed a critical entry point for attackers, allowing them to execute remote code on servers using this protocol. With millions of sites using Next.js and React, the potential impact was vast. This discovery highlighted the importance of thoroughly analyzing new technologies, even those that seem familiar.
Response and Resolution
Meta responded swiftly to Davidson's discovery. The fix released on December 3, 2025, effectively addressed this security flaw. This prompt action was crucial in mitigating risks and protecting users.
Conclusion
The React2Shell story is a reminder of the importance of vigilance in web application development and security. It demonstrates how targeted curiosity and thorough analysis can prevent potential disasters.
Let's discuss your project in 15 minutes.