A newly discovered critical vulnerability, CVE-2025-55182, also known as React2Shell, poses a severe threat to applications built with React Server Components and frameworks such as Next.js.
With a CVSS score of 10.0, the flaw allows pre-authentication remote code execution (RCE) through a single malicious HTTP request.
Microsoft confirmed active exploitation of this vulnerability, with initial attacks observed as early as December 5, 2025.
The vulnerability stems from inadequate validation in the Flight protocol used by React Server Components to transfer serialized data between client and server.
Attackers can inject malicious payloads that bypass validation and execute arbitrary code within the Node.js runtime. Because the flaw affects default configurations, no developer misconfiguration is needed for exploitation.
Public proof-of-concept exploits have demonstrated near-100 % success rates, increasing the urgency of immediate remediation.
Microsoft telemetry indicates that thousands of organizations run potentially vulnerable React-based applications.
Exploitation attempts have been linked to both red-team assessments and real-world attacks that deploy XMRig cryptominers, remote access trojans (RATs) such as VShell and EtherRAT, and the SNOWLIGHT downloader.
Attackers were also observed gaining persistence by modifying Linux authorized_keys files, enabling root login, and deploying Cloudflare Tunnel endpoints to evade detection.
Active Exploitation and Cloud Credential Theft
Following successful exploitation, attackers executed arbitrary commands to open reverse shells, often connecting to Cobalt Strike servers.
Post‑compromise reconnaissance revealed attempts to harvest credentials from cloud services, including Azure, AWS, Google Cloud Platform, and Tencent Cloud via instance metadata endpoints.
In several cases, attackers used tools like TruffleHog, Gitleaks, and custom scripts to extract sensitive secrets and API tokens, including OpenAI API keys and Kubernetes service‑account tokens.
Microsoft Defender researchers also detected exploitation in containerized environments, with severity depending on container security configurations. Compromised systems exhibited signs of lateral movement, credential access, and cryptocurrency mining.
Urgent Patching and Defender Detection Updates
Microsoft has released updated guidance urging organizations to patch immediately. The following versions address the vulnerability:
- React: 19.0.1, 19.1.2, 19.2.1
- Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7
Microsoft Defender customers benefit from expanded detections across endpoints, cloud workloads, and containers. Alerts may indicate suspicious Node.js activity, encoded PowerShell execution, or reverse shell connections.
Additionally, Azure Web Application Firewall (WAF) rules for Application Gateway are now available to block common exploitation patterns during patching.
Organizations are urged to review exposed assets, apply security updates, and monitor telemetry for indicators of compromise.
Microsoft emphasizes that rapid patching, combined with layered Defender monitoring and WAF protections, remains the most effective strategy to minimize the risk of React2Shell exploitation.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
