Loading story…
A critical unauthenticated remote code execution flaw in React Server Components, tracked as CVE-2025-55182 and widely dubbed React2Shell, exposed React 19 server-side packages and downstream frameworks including Next.js App Router. The bug stems from unsafe deserialization in the RSC/Flight protocol, allowing a single crafted HTTP request to reach vulnerable server function paths and execute arbitrary code in default deployments, including some apps that did not explicitly define Server Function endpoints. React released fixes for react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack in 19.0.1, 19.1.2, and 19.2.1, while Next.js issued related guidance under CVE-2025-66478 for affected 15.x, 16.x, and certain canary releases; vendors stressed that WAF rules and hosting-provider mitigations are only temporary and that patching and redeployment are required.
Security firms and vendors reported rapid weaponization after disclosure, with public exploit code, Nuclei and Metasploit support, and confirmed in-the-wild exploitation against internet-facing Next.js and other RSC-enabled applications. Reported post-compromise activity included XMRig cryptominers, Sliver, MeshAgent, Cobalt Strike, SNOWLIGHT, ShadowPAD, credential theft targeting cloud and Kubernetes environments, and persistence mechanisms tied to multiple China-linked actors and other threat groups; CISA added the flaw to its Known Exploited Vulnerabilities catalog. Researchers estimated broad exposure across cloud environments and web assets, while Cloudflare, Akamai, Imperva, Google Cloud, and others deployed emergency protections, underscoring the scale and urgency of remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
18 events from the most recent confirmed update back to the earliest known activity.
The React advisory notes that an additional denial-of-service CVE was added in an update dated January 26, 2026, expanding the set of tracked React Server Components security issues.
Microsoft said exploitation activity had been observed as early as December 5 and that several hundred machines across multiple organizations were compromised, with payloads including coin miners, RATs, ShadowPAD, and SNOWLIGHT.
Rapid7 announced that Metasploit had added an exploit module for CVE-2025-55182, making exploitation tooling more broadly available to defenders and attackers alike.
Next.js published a security update covering downstream impact from CVE-2025-55183 and CVE-2025-55184, and said the initial fix for the DoS issue was incomplete, requiring a further remediation tracked as CVE-2025-67779.
CISA added CVE-2025-55182 to its Known Exploited Vulnerabilities catalog after active exploitation was confirmed, and federal agencies were directed to remediate by December 26, 2025.
Sysdig said it recovered a novel Linux implant named EtherRAT from a compromised Next.js application exploited via CVE-2025-55182, marking a shift toward stealthier persistence-focused post-exploitation.
Multiple later reports state attackers began exploiting CVE-2025-55182 on December 5, 2025, with campaigns targeting public-facing React and Next.js applications shortly after disclosure.
Cloudflare reported issues beginning at 09:09 UTC after deploying a WAF change intended to mitigate the React vulnerability, then deployed a fix about 10 minutes later. The company said the outage was caused by the mitigation change, not by an attack.
Rapid7 reported public proof-of-concept availability and confirmed in-the-wild exploitation, including MeshAgent deployment and exploitation attempts observed by its honeypots. The company also noted CISA had added the flaw to the KEV catalog.
Reporting on the disclosure noted that Google Cloud, alongside Cloudflare, had implemented WAF rules to help protect customers from exploitation attempts against CVE-2025-55182.
ProjectDiscovery introduced a Nuclei template to detect vulnerable Next.js and React Server Components deployments using crafted multipart/form-data requests and RSC-specific fingerprinting.
Following the React2Shell disclosure, researchers identified two more React Server Components issues: CVE-2025-55184, a denial-of-service flaw, and CVE-2025-55183, a source code exposure flaw affecting React 19 and App Router-based frameworks.
Akamai said it deployed an Adaptive Security Engine Rapid Rule to protect customers against exploitation of CVE-2025-55182, while emphasizing that vendor patching remained the primary mitigation.
Cloudflare proactively deployed WAF protections to help shield customers from exploitation of the React Server Components vulnerability while patching efforts were underway.
Next.js published CVE-2025-66478 to track its downstream exposure to the React flaw and released patched versions for affected App Router branches, noting no workaround exists.
The React team publicly disclosed CVE-2025-55182, a critical unauthenticated RCE in React Server Components, and released fixed versions 19.0.1, 19.1.2, and 19.2.1 for affected react-server-dom packages.
Deno implemented a runtime-level mitigation to protect Deno Deploy, Deno Deploy Classic, and subhosting from the React Server Functions exploit ahead of public disclosure.
Researcher Lachlan Davidson responsibly disclosed the React Server Components remote code execution flaw to Meta. Deno states the report was made on 2025-11-29 and that disclosure coordination involved Meta and Vercel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
50 references tracked. Mallory keeps watching after this page renders.
blog.polyswarm.io
Open sourcecsoonline.com
Open sourcecybersecuritynews.com
Open sourcemicrosoft.com
Open sourcecyber.gc.ca
Open sourcerapid7.com
Open sourceimperva.com
Open sourcearcticwolf.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution vulnerability, dubbed **React2Shell**, was discovered in the React 19 library, specifically affecting React Server Components. The flaw allows unauthenticated attackers to execute arbitrary code on servers by sending crafted requests, making it a severe risk for organizations using default React and Next.js deployments. Within hours of public disclosure, security firms including Google’s Threat Intelligence Group and AWS confirmed active exploitation in the wild, highlighting the shrinking window between vulnerability awareness and real-world attacks. Researchers from Wiz and Unit 42 demonstrated that even clean, default deployments were susceptible, emphasizing the widespread impact due to the popularity of these frameworks. Threat actors rapidly weaponized the React2Shell vulnerability, with the RondoDoX botnet launching automated exploitation campaigns targeting both web applications and IoT devices. CloudSEK’s analysis of command and control logs revealed a multi-month campaign, with a significant spike in attacks following the vulnerability’s disclosure in December 2025. The RondoDoX botnet deployed various payloads, including web shells and cryptominers, and quickly adapted its infrastructure in response to security firm reports. Organizations with technology stacks overlapping the targeted vectors were promptly alerted, underscoring the urgent need for patching and monitoring in environments using React 19 and Next.js.
Jun 29, 2026
Threat actors are actively exploiting **React2Shell**, a critical remote code execution flaw in React Server Components tracked as `CVE-2025-55182`, with related exposure also noted in Next.js as `CVE-2025-66478`. The bug stems from insecure deserialization in the React Server Components Flight protocol and allows unauthenticated attackers to upload malicious payloads and execute arbitrary code on vulnerable internet-facing servers. Public disclosure was quickly followed by advisories, proof-of-concept code, and reports of broad exploitation, while Microsoft and other researchers said hundreds of machines had already been hacked. Follow-on campaigns have been widespread and largely opportunistic, ranging from credential-harvesting operations to malware deployment against organizations in multiple sectors and regions. Cisco Talos-linked reporting said at least **766 servers** were compromised by an automated campaign that stole SSH keys, cloud tokens, API keys, Kubernetes and GitHub credentials, Docker metadata, and other environment secrets, including keys tied to AI platforms and payment services. Other investigations tied exploitation to **XMRig**, **RustoBot**, **Kaiji**, **Sliver**, **CrossC2**, **Tactical RMM**, **VShell**, and **EtherRAT**, along with persistence, reconnaissance, DNS-based exfiltration, and SSH key installation, underscoring how rapidly the vulnerability was weaponized after disclosure.
Jun 29, 2026
Threat actors are actively exploiting **React2Shell** (**CVE-2025-55182**), a critical remote code execution flaw in the Flight protocol used for client-server communication in **React Server Components**. The issue is attributed to **insecure deserialization** that can allow unauthorized code execution on vulnerable servers, with observed targeting across insurance, e-commerce, and IT organizations. Reported payloads include the **XMRig** cryptocurrency miner as well as multiple botnets and remote access tooling; campaigns observed against Russian entities deployed **RustoBot** and **Kaiji**, while other activity distributed malware such as **CrossC2**, **Tactical RMM**, **VShell**, and **EtherRAT**. Affected packages include `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in versions **19.0**, **19.1.0**, **19.1.1**, and **19.2.0**, with fixes available in **19.0.1**, **19.1.2**, and **19.2.1**. Separate reporting highlighted that attackers leveraged a **public proof-of-concept (PoC)** for React2Shell and began targeting organizations within hours, reinforcing that rapid weaponization is now common; defenders are advised to patch and also perform post-patch validation, including checking for indicators of compromise, verifying *Next.js* and dependency versions, rebuilding projects after updates, and confirming lockfiles no longer reference vulnerable package versions.
Jun 29, 2026