CVE-2025-55182 — React2Shell

Critical Remote Code Execution in React Server Components.

Severity: CRITICAL | CVSS v3.1: 10.0 (Maximum) | Status: Actively Exploited

What Is This?

React2Shell is a critical security vulnerability in React Server Components (RSC) — a modern feature that lets React run parts of your web app on the server instead of the browser.

The flaw allows any attacker on the internet — with no login, no special access, and no prior knowledge of your system — to send a single malicious HTTP request to your server and run any code they want on it. That means they can steal data, install malware, lock your files with ransomware, or take full control of your server.

Think of it like this: your server has a door that was supposed to only open for trusted visitors, but it turns out anyone can walk in — just by knocking in a specific way.

Quick Reference

Who Is Affected?

Vulnerable React Versions

react-server-dom-webpack   — versions 19.0.0, 19.1.0, 19.1.1, 19.2.0
react-server-dom-parcel    — versions 19.0.0, 19.1.0, 19.1.1, 19.2.0
react-server-dom-turbopack — versions 19.0.0, 19.1.0, 19.1.1, 19.2.0

Affected Frameworks

⚠️ Important: You are vulnerable even if you do not use Server Actions or Server Functions explicitly — as long as React Server Components are enabled in your app.

✅ Not affected: Apps using only the Pages Router, or apps with no server-side React at all.

Why Is This So Dangerous?

Three reasons make React2Shell exceptionally severe:

1. No authentication required. Anyone on the internet can attempt this attack. No account, no token, no prior access needed.

2. Works on default installations. A brand-new Next.js app created with create-next-app — with zero custom configuration — is immediately exploitable. Developers do not have to do anything wrong to be vulnerable.

3. Near-100% reliability. Security researchers confirmed the exploit works almost every time against unpatched servers.

How Does the Attack Work?

The Root Cause — In Plain English

When your React server receives data from a client, it processes (deserializes) that data to understand what to do next. The problem is that React never checks whether that data is safe or legitimate — it blindly trusts whatever arrives.

An attacker exploits this by sending specially crafted data that hijacks internal JavaScript behavior on the server, ultimately allowing them to inject and execute their own code.

Technical Explanation

The exploit uses a technique called prototype pollution:

1. The attacker sends a crafted HTTP POST request to any RSC endpoint (no special URL needed).
2. The React Flight Protocol parser processes the payload without any structural validation.
3. The malicious payload pollutes Object.prototype.then — a fundamental JavaScript object that all other objects inherit from.
4. This grants the attacker access to JavaScript's Function constructor.
5. The attacker uses the Function constructor to execute arbitrary code as the Node.js server process.

Step 1 — Attacker sends crafted HTTP POST
         ↓
Step 2 — React deserializes payload blindly
         ↓
Step 3 — Object.prototype.then is hijacked (prototype pollution)
         ↓
Step 4 — Function constructor is accessed
         ↓
Step 5 — Attacker's code runs on the server
         ↓
Step 6 — Attacker has full server control

Simplified Code Illustration

// This is a simplified version of the vulnerable code path inside React
function parseFlightRequest(req) {
    const flight = req.body;

    // ❌ NO validation — the server trusts whatever arrives
    const decoded = dangerousDeserialize(flight);  // Attack happens here

    // If the attacker controls decoded.action → RCE
    return executeServerReference(decoded.action);
}

What the Attack Looks Like

POST /?flight=1 HTTP/1.1
Content-Type: text/plain

{
  "status": "resolved_model",
  "$1:__proto__:then": "node:process.mainModule.require('child_process').execSync('id > /tmp/rce')",
  "_formData.get": "$1:constructor:constructor"
}

# Simplified cURL version of the exploit
curl -X POST https://target.com/react?flight=1 \
  -H "Content-Type: text/plain" \
  --data '["$ACTION_REF","__proto__","constructor","<attacker_payload>"]'

🚫 Legal warning: Do not use this against any system you do not own or have explicit written authorization to test.

Fixed Versions — Patch Now

React RSC Packages

💡 Recommendation: Upgrade to 19.2.3 to also fix related follow-on vulnerabilities (CVE-2025-55183, CVE-2025-55184, CVE-2025-67779).

Next.js

How to Protect Yourself — Step by Step

Follow these steps in order. Step 1 and 2 are mandatory. The rest add extra layers of defense.

Step 1 — Upgrade React packages (most important)

# Check your current version
npm list react-server-dom-webpack

# Upgrade to the latest patched version
npm install react-server-dom-webpack@latest
npm install react-server-dom-parcel@latest
npm install react-server-dom-turbopack@latest

Step 2 — Upgrade your framework

# For Next.js — replace X with your patched version from the table above
npm install next@X

Step 3 — Add WAF protection (defense in depth)

⚠️ WAF rules alone are not enough. They cannot block every payload variant. Patching your packages is the only complete fix.

Step 4 — If you cannot patch immediately

• Temporarily disable RSC Flight endpoints on your server.
• This reduces your attack surface until you can apply the patch.

Step 5 — Check if you were already attacked

• Audit your server logs for suspicious POST requests to RSC/flight endpoints before your patch date.
• Look for unusual outbound connections, new user accounts, or unexpected processes.

Step 6 — Assume breach precautions

• Rotate all secrets — API keys, database credentials, session tokens, environment variables.
• Treat any server that ran a vulnerable version as potentially compromised.

Real-World Attack Activity

Scale (As of April 2026)

AWS alone accounts for over one-third of observed attacker infrastructure — meaning attackers are largely operating from cloud-hosted servers to conduct these attacks at scale.

Who Is Attacking?

Multiple distinct threat actor groups have been confirmed exploiting this vulnerability:

China-nexus (State-sponsored)

• Earth Lamia (also tracked as UNC5454 by Google) — linked to China's Ministry of State Security (MSS)
• Jackpot Panda — identified by both AWS and Google threat intelligence teams
• Also conducting parallel exploitation of other recent vulnerabilities simultaneously

Iran-nexus

• Iran-affiliated actors observed by Google GTIG in December 2025

North Korea (DPRK) ⚠️ New — January 2026

• Indicators tied to the Contagious Interview campaign (a long-running DPRK operation that targets software developers)
• Deploy EtherRAT — a new backdoor that uses blockchain-based command-and-control infrastructure, making it very difficult to block with standard IP/domain blocking

Cybercriminals / Financially Motivated

• Ransomware operators confirmed using React2Shell for initial access ⚠️ New — December 2026
• At least one case documented where ransomware was deployed in under one minute after initial exploitation
• Cryptocurrency mining (XMRig) widely deployed across opportunistic campaigns

Malware Observed in the Wild

💡 What is an in-memory web shell? It is a backdoor that runs entirely in server memory — leaving no files on disk, making it extremely hard to detect with standard antivirus or file-scanning tools.

💡 What is blockchain-based C2? Instead of connecting to attacker servers via normal IP addresses or domains (which can be blocked), EtherRAT receives its commands from blockchain transactions — a decentralized system that cannot be easily taken down or blocked.

Detection Tools

Microsoft Defender for Cloud

Two dedicated templates are available in the security explorer gallery:

• Internet exposed containers running container images vulnerable to React2Shell — CVE-2025-55182
• Internet exposed virtual machines vulnerable to React2Shell — CVE-2025-55182

Microsoft Security Exposure Management also automatically maps React2Shell attack paths across your cloud infrastructure.

GreyNoise

A ready-to-use block template is available: React Server Components Unsafe Deserialization CVE-2025-55182 RCE Attempt

Full attacker fingerprint datasets (ASN, JA4T, JA4H) are publicly available:

github.com/GreyNoise-Intelligence/gn-research-supplemental-data/tree/main/2026-01-06-react2shell

Dynatrace

Use Runtime Vulnerability Analytics — filter by CVE-2025-55182 to identify vulnerable React or Next.js packages in your environment.

Fake Exploit Warning

After disclosure, approximately 145 fake and non-functional exploit tools were circulated online — many generated by AI. Risks of using unverified tools:

• False sense of security ("not vulnerable" result when you actually are)
• The fake tool itself may contain malware
• Wasted time and misleading conclusions

Only use scanners from verified, community-trusted sources.

Related Vulnerabilities

Full Timeline

Nov 29, 2025  Lachlan Davidson privately reports the vulnerability to Meta / React team

Dec 03, 2025  Patched packages published to npm
              CVE-2025-55182 publicly disclosed
              Vercel deploys runtime-level protections (not just WAF)
              Cloudflare WAF rules activated
              Mass automated scanning begins within hours of disclosure

Dec 04, 2025  First working public exploit released by Moritz Sanft
              Default create-next-app confirmed exploitable with no changes

Dec 05, 2025  Discoverer Lachlan Davidson releases his own PoC (~30 hours post-disclosure)
              Active exploitation observed in Datadog and Rapid7 honeypots
              Darktrace honeypot infected in 2 minutes after deployment

Dec 05–08     "emerald" and "nuts" malware campaigns deploy Cobalt Strike, Sliver,
              Nezha, FRP, Secret-Hunter; Mirai and Rondo botnets also active
              362 unique attacker IPs observed; 152 with identifiable payloads

Dec 08, 2025  Rapid7 confirms exploitation using the public PoC

Dec 11, 2025  Follow-on CVEs disclosed: CVE-2025-55183 and CVE-2025-55184

Dec 12, 2025  Google GTIG identifies China-nexus threat clusters
              Iran-nexus activity also flagged

Dec 15, 2025  Microsoft confirms hundreds of compromised machines
              Coin miners and backdoors (SNOWLIGHT, HISONIC) deployed at scale
              Microsoft Defender for Cloud templates published

Dec 17, 2025  ⚠️ [NEW] Ransomware operators confirmed using React2Shell for
              initial access — malware deployed in under one minute post-exploitation
              (Reported by BleepingComputer, based on S-RM and Microsoft Defender)

Dec 29, 2025  AWS formally attributes activity to Earth Lamia and Jackpot Panda
              AWS Network Firewall Active Threat Defense rules updated

Jan 06, 2026  GreyNoise publishes full attacker fingerprint dataset
              (8.1M+ attack sessions recorded)

Jan 13, 2026  ⚠️ [NEW] IronGate Security identifies DPRK (North Korea) exploitation
              Indicators linked to Contagious Interview campaign
              EtherRAT (blockchain C2 backdoor) deployed post-exploitation
              Attacker staging involves downloading Node.js runtime before payload

Jan 26, 2026  Additional DoS vulnerability CVE-2026-23864 disclosed and patched

Mar 04, 2026  Dynatrace advisory updated with latest remediation guidance

References

Vulnerability Credit: Original discovery and responsible disclosure by Lachlan Davidson (November 29, 2025).

Last updated: April 16, 2026 This document is for educational and defensive security purposes only.