Skip to content
HACKTECH
Exploited vulnerabilitiesReported Published 5 sources

React2Shell: React Server Components RCE exploited within hours of disclosure

The React team disclosed CVE-2025-55182 on 3 December 2025, an unauthenticated remote code execution flaw rated CVSS 10.0 in how React decodes payloads sent to Server Function endpoints, affecting React Server Components packages in versions 19.0 to 19.2.0 and frameworks built on them, including Next.js. AWS reported exploitation attempts by China state-nexus groups within hours of disclosure. SecurityWeek reported that CISA added the flaw to its Known Exploited Vulnerabilities catalogue and that researchers observed attempted theft of AWS configuration and credential files, as well as attempts to deliver cryptocurrency miners and Mirai malware.

  • React
  • React2Shell
  • CVE-2025-55182
  • Next.js
  • remote code execution
  • CISA KEV
  • Node.js

What the sources report

  • Vulnerable versions are 19.0, 19.1.0, 19.1.1 and 19.2.0 of react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack, fixed in 19.0.1, 19.1.2 and 19.2.1; affected frameworks and bundlers include next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk (React).
  • The flaw was reported through Meta Bug Bounty on 29 November 2025; React says apps can be vulnerable even if they implement no Server Function endpoints, as long as they support React Server Components.
  • AWS (4 December 2025) linked early exploitation attempts to infrastructure associated with Earth Lamia and Jackpot Panda, while noting that shared anonymisation infrastructure makes definitive attribution challenging; one unattributed cluster sent 116 requests over 52 minutes to AWS MadPot honeypots, trying whoami and id, attempting to write /tmp/pwned.txt and trying to read /etc/passwd.
  • SecurityWeek (8 December 2025) cited Shadowserver counting more than 77,000 IPs hosting vulnerable instances and Palo Alto Networks confirming more than 30 affected organisations.
  • CISA added the flaw to its KEV catalogue on 5 December 2025 with a 26 December deadline for federal agencies, then brought the deadline forward to 12 December, a change a CISA spokesperson confirmed to The Record; catalogue version 2026.11.06 lists ransomware use as 'Known' (SecurityWeek, The Record, CISA KEV data).
  • React's advisory was later updated with CVE-2025-55184 and CVE-2025-67779 (denial of service, CVSS 7.5), CVE-2025-55183 (source code exposure, CVSS 5.3) and, on 26 January 2026, CVE-2026-23864 (denial of service, CVSS 7.5).
  • AWS indicators include POST requests with next-action or rsc-action-id headers and request bodies containing $@ or "status":"resolved_model".

What it means for your organisation

Server Components moved deserialisation of client-supplied data onto internet-facing servers, and one deserialisation flaw gave unauthenticated code execution across a widely used framework stack. Exploitation attempts began within hours, faster than most monthly patch cycles, and reported activity included attempts to steal cloud credential files, which turns a web application bug into a cloud incident. Teams need a dependency inventory that reaches framework internals and the ability to ship a fix the same day.

What we check

  • Enumerate react-server-dom-* and next versions in deployed builds and container images, including transitive dependencies, against React's fixed versions.
  • Search web and WAF logs from 3 December 2025 onward for POST requests with next-action or rsc-action-id headers and bodies containing $@ or "status":"resolved_model".
  • Hunt on application hosts for unexpected execution of whoami, id or uname, reads of /etc/passwd, new files in /tmp and new processes spawned by the Node.js application.
  • Review which cloud credentials and configuration files the Node.js runtime can read, and rotate any that may have been exposed.
  • Confirm the follow-on fixes for CVE-2025-55183, CVE-2025-55184, CVE-2025-67779 and CVE-2026-23864 are deployed.

Sources

Services that cover these checks

  • Web application testing

    Authenticated, role-aware testing of your application and its API surface, with an account for every role. We chain small findings into the access they lead to, such as a sequential invoice ID and a missing tenant check that together let one customer read another's invoices.

    Duration: 5 to 10 working days

  • Application security audit

    A white-box review of your application: source code, architecture, dependencies and build pipeline. Automated analysis finds the candidates; reviewers confirm each one by reading the code path, and only confirmed defects reach the report, each with a file and line reference.

    Duration: 5 to 15 working days, depending on codebase size

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Cloud configuration review

    An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.

    Duration: 4 to 8 working days

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works