#react-server-components

Analysis · May 5, 2026 · The Field Notes Desk

React2Shell turned every Next.js App Router deployment into a pre-auth RCE target

Lachlan Davidson reported CVE-2025-55182 to Meta on a Friday. By the following Thursday, ransomware groups were deploying payloads within one minute of initial access. A 200-byte POST, CVSS 10, 137,000 exposed instances, and most developers never knew their frontend had server-side attack surface.