How to Patch React2Shell in Next.js, Containers and Kubernetes

React2Shell (CVE-2025-55182) is a CVSS 10.0 remote code execution flaw in React Server Components. It has been in CISA's Known Exploited Vulnerabilities catalog since December 2025, and any app that missed the fix is still exposed today. This guide shows how to check your app, patch it, ship the fix through containers and Kubernetes, and clean up afterwards.

If you missed the background, read our breakdown of the October 2026 2Shell attacks first.

Before you start: what "patched" means

Next.js (App Router), fixed releases:

• 16.0.x: 16.0.10

• 15.5.x: 15.5.9

• 15.4.x: 15.4.10

• 15.3.x: 15.3.8

• 15.2.x: 15.2.8

• 15.1.x: 15.1.11

• 15.0.x: 15.0.7

• 14.x: 14.2.35

React Server Components packages (react-server-dom-webpack, -parcel and -turbopack):

• 19.2.x: 19.2.3

• 19.1.x: 19.1.4

• 19.0.x: 19.0.3

Any framework that uses React Server Components is affected, including React Router's RSC mode, Waku, RedwoodSDK and RSC plugins for Vite and Parcel. Apps that only render React in the browser are not.

Part 1: Patch the application code

Check what you are running

From your app's root folder:

npm ls next react react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel

Compare each version with the list above. With pnpm or yarn, use pnpm why next or yarn why next instead.

Upgrade with Vercel's fix tool

Vercel publishes a tool that finds and upgrades vulnerable packages:

npx fix-react2shell-next

Or upgrade manually

Install the fixed release for your line, for example on Next.js 15.5:

npm install [email protected]

For frameworks other than Next.js, upgrade the RSC package directly:

npm install [email protected]

Commit and test

Commit both package.json and the lockfile, so CI installs exactly the fixed versions. Then run your build and tests:

npm ci && npm run build

Part 2: Patch the container image

Rebuild without cache

Cached dependency layers can keep the old packages. Rebuild from scratch:

docker build --pull --no-cache -t registry.example.com/web:2026-10-30 .

Verify the image

Check the Next.js version inside the image:

docker run --rm registry.example.com/web:2026-10-30 node -e "console.log(require('next/package.json').version)"

If your image uses Next.js standalone output, run the same check from the folder that contains node_modules.

Scan the image:

trivy image registry.example.com/web:2026-10-30

While you rebuild, move the base image to a patched Node.js release (22.23.4, 24.22.1 or 26.12.1) to close Node2Shell at the same time.

Push the image with a new, unique tag:

docker push registry.example.com/web:2026-10-30

Part 3: From Docker to Kubernetes — roll it out

Step 1: Find every workload running your app.

kubectl get pods -A -o jsonpath='{..image}' | tr ' ' '\n' | sort -u

Step 2: Update the image. Commit the new tag in GitOps or Helm, or for a quick manual change:

kubectl set image deployment/web web=registry.example.com/web:2026-10-30 -n prod

Step 3: Watch the rollout.

kubectl rollout status deployment/web -n prod

Step 4: Verify inside a running pod.

kubectl exec -n prod deploy/web -- node -e "console.log(require('next/package.json').version)"

Step 5: Make sure no old pods remain. Run the Step 1 command again and confirm the old tag is gone from every namespace.

Rotate your secrets

Prioritise:

• Database passwords and connection strings.

• API keys for payment, email and third-party services.

• Cloud credentials and tokens available to the app.

• Session and JWT signing secrets.

Then review logs for unusual POST requests to Server Component routes and for unexpected outbound connections from the app's pods.

Can't patch today?

• Turn on your WAF provider's managed rule for CVE-2025-55182, if it has one.

• Restrict preview and staging deployments so they are not publicly reachable.

• Limit outbound network access from the app's pods so a compromised pod can't reach the internet freely.

Quick checklist

• Next.js on 16.0.10, 15.5.9, 15.4.10, 15.3.8, 15.2.8, 15.1.11, 15.0.7 or 14.2.35

• RSC packages on 19.2.3, 19.1.4 or 19.0.3 for non-Next.js frameworks

• package.json and lockfile committed, and the app rebuilt and tested

• Images rebuilt with no cache, on a patched Node.js base, and pushed with unique tags

• Every pod, including preview and staging, runs the new image

• All application secrets rotated

How Turf Dev can help

React2Shell is almost a year old, but preview environments, forgotten services and stale images make it easy to miss a running copy. Turf Dev audits Kubernetes and cloud estates to find every running copy of your app, checks image versions and secret exposure, and rescans after the fix to prove it landed. Reach out at turfdev.in.