React2Shell: Critical Vulnerability in React Server Components
React2Shell: Critical Vulnerability in React Server Components#### One of the most severe security threats of 2025 has emerged in the web development landscape. The vulnerability designated as React2Shell (CVE-2025–55182) enables remote code execution on servers utilizing React Server Components. With a maximum CVSS score of 10.0, this flaw poses an existential threat to millions of web applications worldwide.
What is React2Shell?
React2Shell is a critical unsafe deserialization vulnerability in React Server Components. The name is a deliberate reference to the notorious Log4Shell vulnerability discovered in 2021, which paralyzed thousands of organizations. Like its predecessor, React2Shell allows attackers to execute arbitrary code on affected servers without any authentication.
The vulnerability was discovered by security researcher Lachlan Davidson, who responsibly disclosed it to the Meta team on November 29, 2025. Coordinated disclosure occurred on December 3, 2025, when both React and Vercel simultaneously released security patches.
Technical Details
The core issue lies in how React Server Components process the Flight protocol. This protocol facilitates communication between client and server when rendering React components on the server side.
An attacker can send a specially crafted HTTP request to any Server Function endpoint. During deserialization of this request, malicious code executes before any authentication or validation occurs. In security researchers’ tests, exploitation achieved near 100% success rate on default configurations.
**⚠️ IMPORTANT: **Applications are vulnerable even if they don’t explicitly use React Server Functions, as long as they support React Server Components.
Affected Versions and Components
Vulnerable Versions
Patched Versions
React 19.0.0
React 19.1.0
React 19.1.1
React 19.2.0
React 19.0.1
React 19.1.2
React 19.2.1
Affected Packages:
• react-server-dom-parcel
• react-server-dom-turbopack
• react-server-dom-webpack
Affected Frameworks:
• Next.js 15.x and 16.x (with App Router)
• React Router RSC preview
• Waku
• RedwoodSDK
• Vite RSC plugin
• Parcel RSC plugin
Impact Scope
According to Wiz analysis, the situation is alarming: 39% of cloud environments contain instances vulnerable to CVE-2025–55182. React and Next.js users include giants like Airbnb, Netflix, TikTok, and tens of millions of other websites.
Next.js framework is present in 69% of cloud environments, with 61% of them running publicly accessible applications. This means nearly half of all cloud environments have potentially exposed Next.js instances.
Active Exploitation by Chinese APT Groups
Within hours of the CVE disclosure, Amazon security teams began detecting active exploitation attempts. Analysis of AWS MadPot honeypot infrastructure identified attackers linked to Chinese state-sponsored groups:
• Earth Lamia — a group targeting financial services, logistics, and government organizations in Latin America, Middle East, and Southeast Asia
• Jackpot Panda — a group operating primarily in East and Southeast Asia
Attackers are using a combination of automated scanners and manually tuned exploits. Amazon documented a case where an attacker spent nearly an hour systematically debugging exploitation attempts against a honeypot — trying commands like whoami, id, attempts to write to /tmp/pwned.txt, and reading /etc/passwd.
Beware of Fake PoC Exploits
JFrog warns about fake proof-of-concept exploits on GitHub that contain malware. Security teams should thoroughly verify sources before any testing.
Indicators of Compromise (IoC)
Network Indicators:
• HTTP POST requests with next-action or rsc-action-id headers
• Request bodies containing $@ patterns or “status”:”resolved_model”
Host-based Indicators:
• Unexpected execution of reconnaissance commands (whoami, id, uname)
• Attempts to read /etc/passwd
• Suspicious file writes to /tmp/ directory
• New processes spawned by Node.js/React application processes
Threat Actor IP Addresses:
206.237.3.150 (Earth Lamia), 45.77.33.136 (Jackpot Panda), 143.198.92.82 (Anonymization Network), 183.6.80.214 (Unattributed cluster)
Recommended Remediation Steps
-
**Immediately update **all React and Next.js applications to patched versions (React 19.0.1, 19.1.2, or 19.2.1)
-
**Check dependencies **— some frameworks (like Next.js) bundle React internally and common dependency management tools may not detect this
-
**Enable WAF rules **— AWS, Cloudflare, and Google Cloud have released updated rules to block exploitation attempts
-
**Review logs **from application and web servers for suspicious activity
-
**Implement monitoring **to detect unexpected Node.js process behavior
Conclusion
React2Shell represents one of the most critical vulnerabilities of 2025 in web development. The combination of maximum CVSS score, ease of exploitation, widespread deployment of affected technologies, and immediate activity from state-sponsored attackers creates a perfect storm.
Organizations running React or Next.js applications should treat patching as an absolute priority — outside normal patch cycles and before mass exploitation with functional public exploits begins.
Sources and Further Reading
—
Sysnetshield** | **Penetration Testing • Red Teaming • Security Training