Vercel Warns React2Shell Exploits Are Active in Vulnerable Apps.

Vercel has issued an update on React2Shell, tracked as CVE-2025-55182, warning that exploit reproductions now exist and are being used to identify and attack vulnerable applications. The company says its Web Application Firewall protections are in place for customers, but emphasises that upgrading affected software is the only complete fix across all hosting providers.

Key details:

• Vercel says React2Shell exploit reproductions are now available and are being actively used.
• The issue is tracked as CVE-2025-55182.
• Vercel WAF protections have been deployed to help reduce exposure on its platform.
• The company states that upgrading is the only full remediation, regardless of provider.
• Vercel has published guidance for teams to review and take action.

For small business owners and builders, this is a reminder that framework and dependency vulnerabilities can quickly move from disclosure to active exploitation. If your app relies on affected React-based tooling or deployments, reviewing Vercel’s guidance and applying upgrades promptly can reduce the risk of compromise.