The endpoint nobody created.

The deserializer trusted that the payload came from React.

That sentence is the entire vulnerability. React Server Components send a serialized UI description from server to browser over a wire format called Flight — a proprietary, React-specific encoding for streams of component output, function references, and promise chunks. Server Functions accept POSTs in the same format, deserialize the payload on the server, and execute the request with full Node.js privileges. The Flight deserializer was written under the assumption that anything arriving in the Flight wire format was emitted by a trusted React client somewhere upstream. The assumption is wrong on its face — the deserializer parses bytes; bytes have no provenance — and the bug is the moment a crafted Chunk object with a hostile then method hijacked promise resolution inside the decoder. But the bug is the mechanism; the assumption is the design.

This is the same trust-assumption shape we have written about on perimeter equipment. FortiOS’s CVE-2024-55591 trusted that requests to /ws/cli/ were localhost-originated because the WebSocket proxy was inside the management plane. SAP NetWeaver’s CVE-2025-31324 trusted that callers of the Visual Composer deployment endpoint were authenticated developers because the developer tier was behind the portal. SharePoint’s CVE-2025-49706 trusted that requests to ToolPane came from a logged-in user because the Referer header pointed at SignOut.aspx. In each case the runtime could not verify the property the authentication design treated as load-bearing. React2Shell applies the same shape to a framework-default endpoint: the runtime cannot verify that bytes in the Flight format were emitted by a React client, because nothing about the bytes carries that property. Proprietary is not authentication.

The framework-default question is the part that makes this CVE operationally different from the perimeter cases. A FortiGate is an appliance an operator chose to deploy at a specific network boundary, and the management plane the auth bypass landed against is a surface the operator explicitly enabled. The Flight endpoint that CVE-2025-55182 exploits is not like that. Every project created with create-next-app since version 13.4 ships with App Router enabled. The Flight endpoint is implicitly active. There is no Server Function declaration to grep for; there is no route the developer wrote down. The application has server-side attack surface because the framework made server-side rendering the default, and the development team adopted the default because the framework documentation recommended it. Nobody on the team explicitly decided to expose a deserialization endpoint to the public internet. The endpoint exists anyway.

Shadowserver counted 137,200-plus internet-exposed IPs running vulnerable code on December 11, 2025. Wiz reported 39 percent of analyzed cloud environments contained vulnerable versions. Those numbers are not measurements of how many teams made bad choices; they are measurements of how many teams followed the framework’s documented path. The exploitation tempo confirmed that the attack surface was worth the cost to weaponize: Weaxor ransomware deployment within one minute of initial access on December 5 (the same day CISA added the CVE to KEV), 35,000-plus daily exploitation attempts by December 10 per Kaspersky telemetry, Earth Lamia and Jackpot Panda harvesting cloud credentials, opportunistic mass-scanning across the Next.js host space within 72 hours. The companion field note carries the timeline, the indicators, the patching mechanics, and the fleet-rebuild problem in full.

The narrow remediation is the one Vercel’s bulletin describes: run npx fix-react2shell-next --fix, accept the lockfile churn, rebuild, redeploy, rotate secrets if logs show the Flight endpoint was hit during the exposure window. The tooling is good. The disclosure turnaround was fast. The vendor response is, in operator terms, the best version of how this kind of disclosure can go. The wider lesson is not about React or Vercel or Meta Bug Bounty’s intake speed. It is that framework defaults create attack surface the development team did not enumerate, the security team did not threat-model, and the compliance program did not put in any inventory. The pattern recurs: Spring Framework’s default-enabled binding behavior created Spring4Shell in 2022; the Java deserialization era created server-side endpoints that ORMs and message buses implicitly exposed. Each generation of framework adds another layer at which a default decision somebody made years ago becomes the attack surface somebody else inherits today. The CVSS column rates the bug; the framework-default column does not exist on the rate sheet. Until it does, the next default-on surface will read the same way as this one.