React2Shell CVE-2025-55182- Shaking React and Next.js Ecosystems

React Server Components promised a revolution in web development—seamless server-side rendering with client interactivity. But a critical flaw dubbed React2Shell has turned that promise into a widespread security crisis. Tracked as CVE-2025-55182 (with Next.js variant CVE-2025-66478), this unauthenticated remote code execution vulnerability carries a perfect CVSS 10.0 score, allowing attackers to seize full control of servers via simple HTTP requests.Disclosed on December 2, 2025, by researcher Lachlan Davidson via the react2shell.com demo site, the bug exposes millions of production deployments across cloud providers, from Vercel to AWS, due to its presence in default React 19.x configurations.

The impact extends far beyond isolated apps. Public scans detected over 200,000 exposed endpoints shortly after disclosure, with enterprise-grade React/Next.js stacks in finance, e-commerce, and SaaS hit hardest. China-nexus threat actors pivoted to it within hours, per AWS telemetry, folding it into living-off-the-land attack chains for persistence and lateral movement.[6] For cybersecurity teams, React2Shell demands immediate triage in vulnerability scanners like Qualys or Tenable, as it evades traditional detection by mimicking legitimate Server Action traffic.

Technical Root Cause: Deserialization Gone Wild

At its core, React2Shell exploits insecure module resolution in the React Flight protocol, which powers Server Components and Actions. The vulnerable code lives in react-server-dom-webpack/server.js (and equivalents), where the requireModule function processes user-controlled action identifiers like module-id#export-name.These arrive in HTTP POST bodies or headers to endpoints such as /api/__rsc or Next.js App Router paths, deserialized without validation via the bundler’s __webpack_require__ primitive.

Bundled Node.js modules—think child_process, vm, or fs—become attack vectors because production builds retain them for dynamic imports. An attacker crafts a payload like vm#runInThisContext followed by JavaScript that executes arbitrary code in the server context, spawning shells or exfiltrating data. No authentication is needed in typical setups, and the endpoint often sits internet-facing for edge rendering. This affects React 19.0.0 through 19.2.0, plus any framework bundling the faulty react-server-dom-* packages (1.0.0-beta.* series).

Next.js amplifies the blast radius. Its App Router defaults to Server Components, embedding the vuln in thousands of Vercel deployments. Even “client-only” apps trigger exposure if the server handles Flight payloads during hydration. Vite, Webpack, or Turbopack users face the same peril unless they pin safe React versions pre-build.

Real-World Exposure: Scale and Sectors at Risk

React2Shell’s footprint is massive. Wiz Research pegged initial exposure at 15-20% of React 19.x cloud instances, translating to hundreds of thousands of vulnerable servers. Tenable’s exposure data shows spikes in high-severity alerts for cpe:2.3:a:reactjs:react:* and Next.js CPEs post-December 3.Sectors like e-commerce (Shopify apps), fintech (Stripe integrations), and SaaS (Notion-like tools) dominate, as they lean on RSC for performance.

Attack surface management tools lit up with unauthenticated POSTs to /__rsc/action paths, some carrying PoC payloads from GitHub repos mirroring react2shell.com. Imperva and Cloudflare reported blocking attempts mimicking legitimate RSC calls, with payloads targeting execSync for reverse shells. In ICS/OT fringes, misconfigured React dashboards inherited the flaw, though core OT vulns like Sprecher’s CVE-2025-41742 drew separate fire.

For enterprises, the chained impact is brutal. Compromise yields root on Node processes, enabling ransomware deployment, credential dumping via fs.readFileSync('/etc/passwd'), or pivots to Kubernetes pods. Rapid7 noted early exploits blending it with SSRF in proxy setups, escalating to cluster escapes.

Exploitation in the Wild: Threat Actor Patterns

Exploitation is straightforward and stealthy. A curl one-liner suffices:curl -X POST https://target.com/api/__rsc \ -H "Content-Type: text/x-component" \ -d '{"action":"vm#runInThisContext","payload":"malicious JS"}'

This triggers server-side eval, often logging as benign 200 OK.Assetnote’s scanner confirms vulns non-destructively by probing parser responses—500 on vulnerable vs. 400 on patched.

As of December 5, 2025, no mass campaigns hit CISA KEV, but targeted ops emerged. AWS flagged China-nexus groups (e.g., Salt Typhoon affiliates) chaining it with stolen creds for C2 beacons. Bitdefender observed ransomware previews in PoCs, hinting at Conti successors testing it.Reddit threads in r/cybersecurity and r/pwnhub buzz with IOCs: anomalous node child_process spawns or Flight payloads with vm# strings.

Detection lags exploits. SIEM rules must hunt:

• POSTs >1KB to RSC paths with base64-like bodies.
• Node errors mentioning “invalid module reference.”
• Sudden outbound connections from app servers.

Patches constrain resolution to allowlisted modules, rejecting Node builtins. Meta’s React blog urged full rebuilds, as cached bundles persist vulns.

Mitigation Roadmap for Enterprises

Immediate Actions:

• Inventory React/Next.js via SCA tools (e.g., Snyk, Dependabot); prioritize internet-facing.
• Patch and rebuild: npm update react@latest next@latest; npm rebuild server bundles.
• Rotate secrets if pre-patch exposure suspected.

Defensive Layers:

• WAF/RASP: Block action IDs with # outside allowlists (e.g., Imperva ruleset).
• Network: mTLS or IP whitelists on RSC endpoints.
• Monitoring: Falco for Node execs; Suricata for Flight sigs.

Long-Term:

• Audit deps for dynamic requires; embrace SBOMs.
• Shift-left: Pre-commit hooks validating RSC usage.
• Incident Response: Assume breach—hunt IOCs like new crons or AWS keys in React logs.

Why React2Shell Matters for SecOps

This vuln underscores React’s server ambitions clashing with security defaults. Millions of devs adopted RSC for DX, but overlooked runtime perils in Node bundles. For pros tracking CISA KEV or Qualys QIDs, fold CVE-2025-55182 into Dec 2025 cycles—query react-server fingerprints and remediate high.

React2Shell isn’t patched-and-done; it’s a wake-up for framework supply chains. With exploits accelerating, unpatched stacks face imminent compromise. Act now, monitor relentlessly, and contribute scanners to harden the ecosystem.