Inside Vercel’s sleep-deprived race to contain React2Shell

The report details React2Shell (CVE-2025-55182), a critical unauthenticated RCE affecting React Server Components and downstream frameworks like Next.js; it prompted an industry-wide emergency response, platform mitigations, and a patch from the React team. The defect saw rapid, widespread exploitation — including millions of attack attempts, dozens of impacted organizations, and a surge in public exploits — and led Vercel to run a coordinated bounty program and mitigation efforts to block exploit attempts and share findings with cloud providers and the open-source community.