Loading story…
Threat actors began actively exploiting React2Shell (CVE-2025-55182), a critical issue affecting Next.js and React Server Components that can enable unauthenticated remote code execution on vulnerable, internet-facing servers. Reporting describes exploitation starting within ~20 hours of public disclosure, with attacks observed as malicious HTTP POST requests targeting routes such as /_next/server and /_next/flight, abusing server-component serialization to inject commands into the application runtime. WhoisXMLAPI attributed a large share of scanning/exploitation activity to the “ILOVEPOOP” toolkit, which used centralized infrastructure (noted as high-traffic nodes hosted in the Netherlands), rotating scanner nodes, and a distinctive request fingerprint including non-standard headers like X-Nextjs-Request-Id: poop1234 and Next-Action: x.
Separately, two additional JavaScript supply-chain/library vulnerabilities were disclosed that can be triggered via attacker-controlled input in Node.js applications. Axios is affected by a high-severity denial-of-service flaw (CVE-2026-25639, CVSS 7.5) in mergeConfig, where a configuration object containing an own __proto__ property can cause a TypeError and crash the Node.js process when user input is parsed (e.g., via JSON.parse()) and passed into Axios configuration. CERT/CC also published VU#458422 for a prototype pollution vulnerability in CASL Ability (versions 2.4.0–6.7.4) in rulesToFields() / setByPath() (extra module), where insufficient sanitization of path segments allows writing to Object.prototype via special keys (e.g., prototype, constructor, and _proto_), potentially enabling broad application compromise up to arbitrary code execution depending on how polluted properties are later used.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
A new Axios vulnerability, CVE-2026-42041, was disclosed involving the mergeDirectKeys configuration merge strategy. Because Axios checked validateStatus with the JavaScript in operator, a polluted Object.prototype.validateStatus could be treated as user-supplied, allowing a malicious response validator that could enable authentication or response-handling bypass.
A new Axios vulnerability, CVE-2026-42035, was disclosed involving prototype pollution in adapter logic that duck-types FormData objects. By inheriting append, getHeaders, and Symbol.toStringTag from a polluted Object.prototype, a plain object can be misclassified as FormData and trigger attacker-controlled header processing.
A critical Axios vulnerability, CVE-2026-40175, was disclosed affecting versions prior to 1.15.0 due to improper HTTP header sanitization in the Node.js HTTP adapter. The issue can let prototype-polluted properties reach request headers, enabling request smuggling, metadata exfiltration, IAM credential theft, and possible cloud account takeover; Axios 1.15.0 was identified as the patched release.
Axios maintainers released updates to address the mergeConfig crash issue affecting Node.js servers that pass untrusted input into Axios configuration merging. Users were urged to upgrade to version 1.13.4 or later, with 1.13.5 specifically noted as restoring stability.
A high-severity denial-of-service flaw in Axios, tracked as CVE-2026-25639 and scored CVSS 7.5, was reported. The issue in mergeConfig can trigger a TypeError and crash Node.js processes when a configuration object contains __proto__ as an own property.
CERT/CC published vulnerability note VU#458422 covering a prototype pollution vulnerability in CASL Ability. No further synopsis details were provided in the reference.
Analysts linked a large share of the React2Shell exploitation activity to a toolkit called ILOVEPOOP. The toolkit was described as using centralized infrastructure based on two high-traffic servers in the Netherlands, rotating scanner nodes, and distinctive HTTP headers for detection.
Attackers began exploiting internet-facing systems shortly after public disclosure, using malicious HTTP POST requests to routes such as /_next/server and /_next/flight. Early activity included high-volume scanning to find exposed targets before they could be patched.
The critical Next.js and React Server Components flaw dubbed React2Shell, tracked as CVE-2025-55182, was publicly disclosed. The bug enables unauthenticated remote code execution via abuse of server component serialization.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
8 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvereports.com
Open sourceaikido.dev
Open sourcecybersecuritynews.com
Open sourcemondoo.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcekb.cert.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical unauthenticated remote code execution flaw in React Server Components, tracked as **CVE-2025-55182** and widely dubbed **React2Shell**, exposed React 19 server-side packages and downstream frameworks including **Next.js App Router**. The bug stems from unsafe deserialization in the RSC/Flight protocol, allowing a single crafted HTTP request to reach vulnerable server function paths and execute arbitrary code in default deployments, including some apps that did not explicitly define Server Function endpoints. React released fixes for `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in **19.0.1**, **19.1.2**, and **19.2.1**, while Next.js issued related guidance under **CVE-2025-66478** for affected 15.x, 16.x, and certain canary releases; vendors stressed that WAF rules and hosting-provider mitigations are only temporary and that patching and redeployment are required. Security firms and vendors reported rapid weaponization after disclosure, with public exploit code, Nuclei and Metasploit support, and confirmed in-the-wild exploitation against internet-facing Next.js and other RSC-enabled applications. Reported post-compromise activity included **XMRig** cryptominers, **Sliver**, **MeshAgent**, **Cobalt Strike**, **SNOWLIGHT**, **ShadowPAD**, credential theft targeting cloud and Kubernetes environments, and persistence mechanisms tied to multiple China-linked actors and other threat groups; CISA added the flaw to its **Known Exploited Vulnerabilities** catalog. Researchers estimated broad exposure across cloud environments and web assets, while Cloudflare, Akamai, Imperva, Google Cloud, and others deployed emergency protections, underscoring the scale and urgency of remediation.
Sep 3, 2026
A critical pre-authentication remote code execution flaw, tracked as **`CVE-2025-55182`** and dubbed **React2Shell**, was disclosed in React Server Components and related React Flight server-side deserialization logic used by **React.js**, **Next.js**, and similar frameworks. The vulnerability affects React Server Components versions **19.0.0**, **19.1.0**, **19.1.1**, and **19.2.0** in the packages **`react-server-dom-webpack`**, **`react-server-dom-parcel`**, and **`react-server-dom-turbopack`**, where unsafe deserialization of HTTP request payloads sent to Server Function endpoints can lead to arbitrary code execution in Node.js before authentication. Public reporting said the flaw was fixed in the React repository through pull request **`#35277`**, and vendor advisories and CISA tracking indicate the issue drew urgent attention. Security researchers later reported active in-the-wild exploitation beginning almost immediately after disclosure, with mass scanning followed by deployment of **Cobalt Strike**, **Sliver**, cryptominers, reverse proxies, a Go backdoor, botnet activity, and a Node.js **Secret-Hunter** payload aimed at stealing credentials and secrets. Observed campaigns targeted both Linux and Windows systems, and analysis tied the root cause to improper property ownership checks in React's `reviveModel` function that allowed attacker-controlled serialized payloads to traverse prototype properties. The official patch replaced unsafe ownership checks with **`Object.prototype.hasOwnProperty.call(...)`**, added explicit handling for **`__proto__`**, and prompted guidance to upgrade affected React and Next.js deployments and monitor exposed Server Function endpoints for exploitation attempts.
Sep 1, 2026
Threat actors are actively exploiting **React2Shell** (**CVE-2025-55182**), a critical remote code execution flaw in the Flight protocol used for client-server communication in **React Server Components**. The issue is attributed to **insecure deserialization** that can allow unauthorized code execution on vulnerable servers, with observed targeting across insurance, e-commerce, and IT organizations. Reported payloads include the **XMRig** cryptocurrency miner as well as multiple botnets and remote access tooling; campaigns observed against Russian entities deployed **RustoBot** and **Kaiji**, while other activity distributed malware such as **CrossC2**, **Tactical RMM**, **VShell**, and **EtherRAT**. Affected packages include `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in versions **19.0**, **19.1.0**, **19.1.1**, and **19.2.0**, with fixes available in **19.0.1**, **19.1.2**, and **19.2.1**. Separate reporting highlighted that attackers leveraged a **public proof-of-concept (PoC)** for React2Shell and began targeting organizations within hours, reinforcing that rapid weaponization is now common; defenders are advised to patch and also perform post-patch validation, including checking for indicators of compromise, verifying *Next.js* and dependency versions, rebuilding projects after updates, and confirming lockfiles no longer reference vulnerable package versions.
Jun 29, 2026