Loading story…
Researchers detailed React2Shell (CVE-2025-55182), a pre-authentication remote code execution flaw in React Server Functions that affects Next.js 15.x through 16.0.6 and other React-based server frameworks and bundlers. The vulnerability was assigned a CVE record, and public reporting described how exploitation could reach backend code paths before authentication, making exposed applications a high-priority patching target.
Follow-on research showed that Vercel’s emergency protections could be bypassed through parser mismatches between the WAF and backend request handling, particularly around multipart/form-data. Researchers validated five bypass classes: duplicate boundary parameters, non-UTF8 header bytes, UTF-16LE multipart field encoding, duplicate per-part Content-Type headers, and trailing spaces in multipart boundary end markers. Vercel reportedly paid more than $1 million in bug bounties across 20 unique bypasses submitted by 116 researchers, and ultimately moved to raw-body inspection to reduce parser differential weaknesses while urging users to patch the underlying flaw.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
According to the article, Vercel paid more than $1 million in bug bounties across 20 unique bypasses submitted by 116 researchers. This reflects the scale of the bypass discovery effort around the emergency protections.
Vercel ultimately changed its WAF approach to inspect raw request bodies rather than rely on parsing that could diverge from backend behavior. This was intended to eliminate parser differential issues that enabled the bypasses.
In response to the bypass research, Vercel repeatedly strengthened its emergency WAF mitigations. The article describes this as an iterative response to newly identified bypass techniques.
Researchers found and validated five classes of bypasses for Vercel’s emergency WAF protections by exploiting parser differentials between the WAF and backend, especially in multipart/form-data handling. The bypasses included duplicate boundary parameters, non-UTF8 header bytes, UTF-16LE multipart field encoding, duplicate per-part Content-Type headers, and trailing spaces in multipart boundary end markers.
The React2Shell pre-authentication remote code execution issue in React Server Functions is tracked as CVE-2025-55182. The provided references identify the vulnerability by this CVE ID.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical unauthenticated remote code execution flaw in React Server Components, tracked as **CVE-2025-55182** and widely dubbed **React2Shell**, exposed React 19 server-side packages and downstream frameworks including **Next.js App Router**. The bug stems from unsafe deserialization in the RSC/Flight protocol, allowing a single crafted HTTP request to reach vulnerable server function paths and execute arbitrary code in default deployments, including some apps that did not explicitly define Server Function endpoints. React released fixes for `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in **19.0.1**, **19.1.2**, and **19.2.1**, while Next.js issued related guidance under **CVE-2025-66478** for affected 15.x, 16.x, and certain canary releases; vendors stressed that WAF rules and hosting-provider mitigations are only temporary and that patching and redeployment are required. Security firms and vendors reported rapid weaponization after disclosure, with public exploit code, Nuclei and Metasploit support, and confirmed in-the-wild exploitation against internet-facing Next.js and other RSC-enabled applications. Reported post-compromise activity included **XMRig** cryptominers, **Sliver**, **MeshAgent**, **Cobalt Strike**, **SNOWLIGHT**, **ShadowPAD**, credential theft targeting cloud and Kubernetes environments, and persistence mechanisms tied to multiple China-linked actors and other threat groups; CISA added the flaw to its **Known Exploited Vulnerabilities** catalog. Researchers estimated broad exposure across cloud environments and web assets, while Cloudflare, Akamai, Imperva, Google Cloud, and others deployed emergency protections, underscoring the scale and urgency of remediation.
Sep 3, 2026
A critical pre-authentication remote code execution flaw, tracked as **`CVE-2025-55182`** and dubbed **React2Shell**, was disclosed in React Server Components and related React Flight server-side deserialization logic used by **React.js**, **Next.js**, and similar frameworks. The vulnerability affects React Server Components versions **19.0.0**, **19.1.0**, **19.1.1**, and **19.2.0** in the packages **`react-server-dom-webpack`**, **`react-server-dom-parcel`**, and **`react-server-dom-turbopack`**, where unsafe deserialization of HTTP request payloads sent to Server Function endpoints can lead to arbitrary code execution in Node.js before authentication. Public reporting said the flaw was fixed in the React repository through pull request **`#35277`**, and vendor advisories and CISA tracking indicate the issue drew urgent attention. Security researchers later reported active in-the-wild exploitation beginning almost immediately after disclosure, with mass scanning followed by deployment of **Cobalt Strike**, **Sliver**, cryptominers, reverse proxies, a Go backdoor, botnet activity, and a Node.js **Secret-Hunter** payload aimed at stealing credentials and secrets. Observed campaigns targeted both Linux and Windows systems, and analysis tied the root cause to improper property ownership checks in React's `reviveModel` function that allowed attacker-controlled serialized payloads to traverse prototype properties. The official patch replaced unsafe ownership checks with **`Object.prototype.hasOwnProperty.call(...)`**, added explicit handling for **`__proto__`**, and prompted guidance to upgrade affected React and Next.js deployments and monitor exposed Server Function endpoints for exploitation attempts.
Sep 1, 2026
A severe remote code execution vulnerability tracked as **`CVE-2025-55182`** was disclosed in **React Server Components** and quickly became known as **React2Shell**, with reporting indicating that exploitation spread soon after public disclosure. Security coverage from eSentire, BitSight, and Computer Weekly described the flaw as affecting React and Next.js environments, warned defenders to assess internet-exposed applications, and noted that attackers were moving from proof-of-concept activity toward broader exploitation. Public GitHub repositories rapidly appeared with exploit code, scanners, and remediation-focused projects, including tools explicitly labeled for **`CVE-2025-55182`** and **React2Shell** detection or exploitation. Repositories such as **`React2Shell-PoC`**, multiple **PoC scanners**, auto-exploit projects, and checkers lowered the barrier to weaponization, while at least one repository advertised fixes for React 19 users. The volume and speed of public tooling indicate that organizations running React Server Components or Next.js services faced immediate pressure to identify exposed systems, apply vendor fixes, and monitor for signs of remote code execution attempts.
Jul 12, 2026