# What's Next: React2Shell Beyond Next.js

DevFeed: [What's Next: React2Shell Beyond Next.js](<https://devfeed.tech/articles/what-s-next-react2shell-beyond-next-js-91565.md>)

Original publisher: [Read original article](<https://www.vulncheck.com/blog/react2shell-beyond-nextjs>)

Author: Cale Black

Published: 2025-12-16T00:00:00Z

Content type: article

Language: en

Sources: [VulnCheck](<https://devfeed.tech/sources/vulncheck.md>)

Topics: [Expo](<https://devfeed.tech/topics/expo.md>), [backend frameworks](<https://devfeed.tech/topics/backend-frameworks.md>)

Tags: [cve-2025-55182](<https://devfeed.tech/tags/cve-2025-55182.md>), [exploitation](<https://devfeed.tech/tags/exploitation.md>), [frameworks](<https://devfeed.tech/tags/frameworks.md>), [initial-access](<https://devfeed.tech/tags/initial-access.md>), [intelligence](<https://devfeed.tech/tags/intelligence.md>), [js](<https://devfeed.tech/tags/js.md>), [next-js](<https://devfeed.tech/tags/next-js.md>), [react2shell](<https://devfeed.tech/tags/react2shell.md>)

## AI overview

VulnCheck reports functional React2Shell exploit variants beyond Next.js and explains how their requirements differ. Parcel and React Router need RSC explicitly enabled; Parcel's `rsc-action-id` must match a server function, while React Router accepts any value. Client-side action IDs and Flight data can help identify targets. Expo requires its `reactServerFunctions` flag and uses predictable bundle and endpoint paths with an `expo-platform` header. Waku uses `/RSC/` `.txt` endpoints; in production, the tested payload executed when sent to a nonexistent endpoint with that path and extension. The findings describe tested setups and exploit behavior, not the prevalence of vulnerable deployments.

## Source excerpt

VulnCheck's Initial Access Intelligence team analyzes React2Shell CVE-2025-55182 exploitability in frameworks that utilize the vulnerable components outside of Next.js alone, with emphasis on exploitation steps and potential fingerprinting paths.