Security teams worldwide are rushing to patch systems after the disclosure of a critical React vulnerability, CVE-2025-55182, widely known as “React2Shell.”
The flaw affects React Server Components (RSC) and carries a maximum CVSS score of 10, the highest possible rating, signaling critical impact and near-trivial exploitation difficulty.
The scope of exposure is staggering. Censys telemetry reveals that more than 2.15 million internet-facing services are running technologies that may be impacted, including applications built with Next.js, Waku, React Router RSC, Vite RSC, Parcel RSC, and RedwoodSDK.
While not all instances are confirmed vulnerable, the sheer volume of potentially affected systems underscores the urgency facing organizations worldwide.
The Technical Flaw: Insecure Deserialization
React2Shell stems from how React Server Components and related packages handle data sent to Server Function endpoints.
React’s server-side packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack perform insecure deserialization of JSON payloads.
An unauthenticated attacker can send a specially crafted HTTP request to a vulnerable endpoint, forcing the server to execute arbitrary JavaScript code.
The implications are severe: complete remote code execution (RCE) on the server with no authentication required.
React has confirmed that even applications that do not explicitly use Server Functions may remain vulnerable if they support RSC on the server side.
However, pure client-side React applications that do not use RSC or RSC-capable frameworks are unaffected.
Active Exploitation Underway
The vulnerability is no longer theoretical. AWS security teams observed China-nexus threat actors exploiting React2Shell within 24 hours of public disclosure.
Reported groups, including Earth Lamia and Jackpot Panda, are leveraging the vulnerability to gain initial access, then deploy web shells, backdoors, and additional malicious tooling to achieve persistent compromise.
CISA has expedited CVE-2025-55182 into its Known Exploited Vulnerabilities (KEV) catalog, formally acknowledging active real-world exploitation.
This designation mandates priority patching for federal and private-sector networks alike. Multiple public proof-of-concept exploits have surfaced, dramatically lowering barriers for opportunistic attackers, though some PoCs are themselves malicious or fake, requiring caution during remediation efforts.
The vulnerability impacts React server packages in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. Dependent frameworks are similarly affected, including Next.js (App Router), React Router RSC preview, Waku, Vite RSC plugin, Parcel RSC plugin, and RedwoodSDK.
For Next.js specifically, versions 14.3.0-canary.77 and later, all 15.x, and all 16.x using the App Router should be presumed vulnerable until verified.
Vendors responded swiftly. React released patched versions 19.0.1, 19.1.2, and 19.2.1, while Next.js published fixed releases across supported branches (15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7).
Cloud providers, including Cloudflare and AWS, deployed WAF rules to block known exploit patterns, yet researchers have already demonstrated bypass techniques.
Organizations must immediately inventory internet-facing assets using RSC, confirm package versions, and upgrade to patched releases.
Temporary WAF protections should not replace actual patching. Given active exploitation and the massive exposure footprint, unpatched RSC-enabled services pose a critical risk that requires urgent remediation.
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=The scope of exposure is staggering. Censys telemetry reveals that more than 2.15 million internet-facing services are running technologies that may be impacted){kind=link}