Vulnerability Overview

CVE Identifier: CVE-2025-55182 (nicknamed “React2Shell”)
Severity: CRITICAL (CVSS 10.0/10)
Vulnerability Type: Insecure Deserialization / Remote Code Execution
Exploitation Status: Mass active exploitation since December 5, 2025
Attack Complexity: Low
Privileges Required: None (unauthenticated)
User Interaction: None
Attack Vector: Network (Remote)
Impact: Complete server compromise via a single HTTP request
Affected Software: React 19.0.0–19.1.0, Next.js (all versions using React 19), Angular, and other frameworks implementing React Server Components
Disclosure Date: December 2, 2025
Patch Status: Patched in React 19.1.1+, Next.js 15.2.7+, 16.0.1+
CISA KEV Addition: December 8, 2025
Threat Actors: Chinese state-sponsored (MSS-linked), cybercriminals, botnet operators

What Is React2Shell and Why It’s So Dangerous

React2Shell is a flaw in how React Server Components process data sent from a browser back to the server. Under normal conditions, this data describes what the user did — clicking a button, submitting a form, or triggering a server action.

The problem is that React trusted this data too much.

Attackers discovered they could send a specially crafted request that looks like a valid React Server Component message but actually contains instructions that the server ends up executing. Once that happens, the attacker can run arbitrary code on the server.

There’s no login step.
There’s no permission check.
The server just executes what it’s given.

That’s why this vulnerability is so severe.

Why This Affects So Many Applications

React Server Components were introduced in React 19 and enabled by default in popular frameworks like Next.js. That meant millions of applications became vulnerable simply by upgrading to the latest version.

Developers didn’t misconfigure anything.
Security settings weren’t turned off.
This was the default behavior.

As soon as proof-of-concept exploits were shared publicly in early December, attackers began scanning the internet for vulnerable applications. In many cases, servers were compromised within minutes of being found.

How the Attack Works (Step by Step)

Here’s how a typical React Server Components request works:

1. A user interacts with a page (for example, submitting a form).
2. The browser sends a request containing structured React data.
3. The server processes that data and sends back an updated response.

React2Shell abuses this process.

The Exploitation Flow

1. Target Identification
   Attackers identify applications using React 19 or Next.js by inspecting response headers, JavaScript bundles, or common URL patterns.
2. Payload Creation
   A malicious request is crafted using React’s internal data format. It looks legitimate but contains objects designed to execute code when the server reconstructs them.
3. Single Request Delivery
   The attacker sends one HTTP POST request to a server action endpoint.
4. Unsafe Deserialization
   React deserializes the data without proper validation and unintentionally executes attacker-controlled logic.
5. Server Compromise
   The attacker now has full control of the server process.

This entire chain happens automatically and silently.

What Attackers Do After Gaining Access

Once code execution is achieved, attackers typically:

• Download additional tools using curl or wget
• Install cryptocurrency miners that consume server CPU
• Drop backdoors for persistent access
• Read configuration files and environment variables
• Steal database credentials, API keys, and secrets
• Pivot into cloud or container environments

In Kubernetes deployments, attackers often target service account tokens to move laterally within the cluster.

Real-World Exploitation Activity

This vulnerability is not theoretical. Researchers observed exploitation starting just days after disclosure.

Multiple groups are actively using React2Shell:

• State-sponsored attackers focusing on long-term access and intelligence collection
• Cybercriminal groups deploying miners, ransomware, and botnet payloads
• Automated scanners compromising anything they find without discrimination

Because exploitation is easy and reliable, even low-skill attackers are successfully using it.

Why the Severity Is 10.0

React2Shell meets every condition for the highest possible severity rating:

• Exploitable over the internet
• No authentication required
• No user interaction
• Very low technical complexity
• Full compromise of the server

Vulnerabilities with this profile are rare — and extremely dangerous.

How to Spot Possible Compromise

Signs that a system may have been affected include:

• Unexpected POST requests to server action endpoints
• Node.js processes spawning shell commands
• High CPU usage without explanation
• New files in temporary directories
• Outbound connections to unfamiliar IP addresses
• Modified startup scripts or scheduled jobs

If any of these are present, assume compromise and investigate immediately.

What Needs to Be Done Right Away

Patch Immediately

• Upgrade React to 19.1.1 or newer
• Upgrade Next.js to the latest patched release
• Rebuild and redeploy applications

Assume Exposure

Even after patching:

• Review logs from early December onward
• Rotate secrets and credentials
• Inspect servers for persistence mechanisms

Add Temporary Protection

Until patching is complete:

• Apply WAF rules to limit suspicious requests
• Rate-limit server action endpoints
• Monitor for malformed request payloads

Final Thoughts

React2Shell is a reminder that modern frameworks can introduce system-wide risk overnight. This vulnerability didn’t require bad code or unsafe configurations — it was enabled by default and widely deployed.

If a vulnerable application is still online, it should be considered actively exposed.