React2Shell Security Bulletin | Vercel Knowledge Base

This bulletin details the React2Shell vulnerability (CVE-2025-55182) affecting React Server Components and frameworks like Next.js. It outlines required actions for users, including immediate upgrades to patched versions of Next.js (15.0.0 through 16.0.6) and other frameworks using RSC. It also details Vercel's security actions, including WAF rules, automated upgrades via Vercel Agent, command-line utilities (`npx fix-react2shell-next`), manual upgrade steps, and recommendations for rotating environment variables. Deployment protection is strongly recommended for all deployments besides production domains.