Loading story…
A critical pre-authentication remote code execution flaw, tracked as CVE-2025-55182 and dubbed React2Shell, was disclosed in React Server Components and related React Flight server-side deserialization logic used by React.js, Next.js, and similar frameworks. The vulnerability affects React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 in the packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, where unsafe deserialization of HTTP request payloads sent to Server Function endpoints can lead to arbitrary code execution in Node.js before authentication. Public reporting said the flaw was fixed in the React repository through pull request #35277, and vendor advisories and CISA tracking indicate the issue drew urgent attention.
Security researchers later reported active in-the-wild exploitation beginning almost immediately after disclosure, with mass scanning followed by deployment of Cobalt Strike, Sliver, cryptominers, reverse proxies, a Go backdoor, botnet activity, and a Node.js Secret-Hunter payload aimed at stealing credentials and secrets. Observed campaigns targeted both Linux and Windows systems, and analysis tied the root cause to improper property ownership checks in React's reviveModel function that allowed attacker-controlled serialized payloads to traverse prototype properties. The official patch replaced unsafe ownership checks with Object.prototype.hasOwnProperty.call(...), added explicit handling for __proto__, and prompted guidance to upgrade affected React and Next.js deployments and monitor exposed Server Function endpoints for exploitation attempts.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Trend Micro published an analysis of CVE-2025-55182, detailing the React Flight deserialization flaw, proof-of-concept mechanics, patched code behavior, and in-the-wild exploitation observed after disclosure. The report also documented malware, C2 infrastructure, and credential-theft activity tied to exploitation.
An updated advisory said Next.js was affected by CVE-2025-55182 because it relies on React Server Components, and listed fixed releases 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7. The advisory also noted that CVE-2025-66478 for Next.js had been marked as a duplicate of CVE-2025-55182.
CISA added CVE-2025-55182 (React2Shell) to its Known Exploited Vulnerabilities catalog, assessing it as actively exploited, automatable, and capable of total technical impact. The KEV metadata identified known ransomware-campaign use and set a December 12 remediation due date.
Jan Schaumann posted CVE-2025-55182 to the oss-security mailing list, describing a critical pre-authentication remote code execution flaw in React Server Components affecting versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. The post said the issue stemmed from unsafe deserialization in Server Function endpoints and referenced a fix in React pull request #35277.
Trend Micro reported a notable surge in exploitation attempts for CVE-2025-55182 between December 5 and December 8, 2025, including mass scanning and multiple emerging campaigns. The activity included Linux and Windows targeting, botnet deployment, and post-exploitation tooling.
A GitNation talk titled "Meet React Flight and Become a RSC Expert" by Mauro Bartolomeoli was published, providing background on React Flight and React Server Components relevant to the later vulnerability story.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
trendaisecurity.com
Open sourcevulnerability.circl.lu
Open sourcemnemonic.io
Open sourcegitnation.com
Open sourceopenwall.com
Open sourcefacebook.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical unauthenticated remote code execution flaw in React Server Components, tracked as **CVE-2025-55182** and widely dubbed **React2Shell**, exposed React 19 server-side packages and downstream frameworks including **Next.js App Router**. The bug stems from unsafe deserialization in the RSC/Flight protocol, allowing a single crafted HTTP request to reach vulnerable server function paths and execute arbitrary code in default deployments, including some apps that did not explicitly define Server Function endpoints. React released fixes for `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in **19.0.1**, **19.1.2**, and **19.2.1**, while Next.js issued related guidance under **CVE-2025-66478** for affected 15.x, 16.x, and certain canary releases; vendors stressed that WAF rules and hosting-provider mitigations are only temporary and that patching and redeployment are required. Security firms and vendors reported rapid weaponization after disclosure, with public exploit code, Nuclei and Metasploit support, and confirmed in-the-wild exploitation against internet-facing Next.js and other RSC-enabled applications. Reported post-compromise activity included **XMRig** cryptominers, **Sliver**, **MeshAgent**, **Cobalt Strike**, **SNOWLIGHT**, **ShadowPAD**, credential theft targeting cloud and Kubernetes environments, and persistence mechanisms tied to multiple China-linked actors and other threat groups; CISA added the flaw to its **Known Exploited Vulnerabilities** catalog. Researchers estimated broad exposure across cloud environments and web assets, while Cloudflare, Akamai, Imperva, Google Cloud, and others deployed emergency protections, underscoring the scale and urgency of remediation.
Sep 3, 2026
Threat actors are actively exploiting **React2Shell** (**CVE-2025-55182**), a critical remote code execution flaw in the Flight protocol used for client-server communication in **React Server Components**. The issue is attributed to **insecure deserialization** that can allow unauthorized code execution on vulnerable servers, with observed targeting across insurance, e-commerce, and IT organizations. Reported payloads include the **XMRig** cryptocurrency miner as well as multiple botnets and remote access tooling; campaigns observed against Russian entities deployed **RustoBot** and **Kaiji**, while other activity distributed malware such as **CrossC2**, **Tactical RMM**, **VShell**, and **EtherRAT**. Affected packages include `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in versions **19.0**, **19.1.0**, **19.1.1**, and **19.2.0**, with fixes available in **19.0.1**, **19.1.2**, and **19.2.1**. Separate reporting highlighted that attackers leveraged a **public proof-of-concept (PoC)** for React2Shell and began targeting organizations within hours, reinforcing that rapid weaponization is now common; defenders are advised to patch and also perform post-patch validation, including checking for indicators of compromise, verifying *Next.js* and dependency versions, rebuilding projects after updates, and confirming lockfiles no longer reference vulnerable package versions.
Jun 29, 2026
A severe remote code execution vulnerability tracked as **`CVE-2025-55182`** was disclosed in **React Server Components** and quickly became known as **React2Shell**, with reporting indicating that exploitation spread soon after public disclosure. Security coverage from eSentire, BitSight, and Computer Weekly described the flaw as affecting React and Next.js environments, warned defenders to assess internet-exposed applications, and noted that attackers were moving from proof-of-concept activity toward broader exploitation. Public GitHub repositories rapidly appeared with exploit code, scanners, and remediation-focused projects, including tools explicitly labeled for **`CVE-2025-55182`** and **React2Shell** detection or exploitation. Repositories such as **`React2Shell-PoC`**, multiple **PoC scanners**, auto-exploit projects, and checkers lowered the barrier to weaponization, while at least one repository advertised fixes for React 19 users. The volume and speed of public tooling indicate that organizations running React Server Components or Next.js services faced immediate pressure to identify exposed systems, apply vendor fixes, and monitor for signs of remote code execution attempts.
Jul 12, 2026