Our $1 million hacker challenge for React2Shell

This post details Vercel's response to the React2Shell vulnerability (CVE-2025-55182), which allowed for remote code execution via vulnerable React Server Components. Vercel implemented a multi-layered defense strategy: 1. A $1 million bug bounty program with HackerOne to identify WAF bypasses, leading to 20 unique WAF updates and the permanent integration of 38 discovered bypass techniques into the Seawall WAF. 2. A compute-layer runtime mitigation that directly prevents code evaluation via the `constructor` property, covering 96% of Vercel traffic. The post highlights specific bypass techniques like recursive UTF-encoding and the exploitation of `ReadableStream` error messages, and Vercel's adaptation of Deno's runtime mitigation for Node.js.