Security Update: Rocket.Chat Not Affected by “react2shell” (CVE-2025-55182)CVE-2025-55182, also known as “react2shell,” impacts applications that rely on React Server Components (RSC).
The issue allows malicious input to be executed on the server through improperly handled RSC payloads.
Rocket.Chat is not affected.
Rocket.Chat does not use React Server Components anywhere in our platform, and therefore the attack vector exploited in “react2shell” simply does not apply to our architecture.
As always, our Security and Engineering teams continuously monitor upstream advisories, validate potential impacts on our stack, and ensure we remain compliant with best practices in secure development.
Stay safe and keep communicating securely,
Rocket.Chat