Introduction


The security community was recently shaken by React2Shell, a critical unauthenticated Remote Code Execution (RCE) vulnerability. It was initially tracked under two CVEs:


CVE-2025-55182 – React
CVE-2025-66478 – Next.js


With a CVSS score of 10.0, this vulnerability impacts Next.js...