CVE-2025-55182 (React2Shell)

Critical RCE in React Server Components Under Active Exploitation

December 3, 202517 min read

Anime-styled developer discovering security vulnerability in React code on dual monitors displaying React2Shell exploit with warning icons and neon cybersecurity aesthetic — "Illustrated developer uncovering React2Shell vulnerability in React framework code, featuring dual displays with security alerts and neon hacker aesthetic"
Photo by Perplexity Labs

What did you think?

Feel free to send us a message with your thoughts, or learn more about us!

Comments

JANUARY 2026 UPDATE: One month after disclosure, React2Shell (CVE-2025-55182) remains under sustained exploitation with over 8.1 million attack sessions recorded¹. Security firm GreyNoise reports 300,000-400,000 daily attacks from 8,163 unique IPs across 101 countries¹. Over 644,000 domains remain vulnerable despite patches being available since December 3, 2025². CISA’s federal remediation deadline (December 26, 2025) has passed³. If you haven’t upgraded to React 19.2.3⁴ and Next.js 16.0.10+, you are actively at risk.

December 2025 UPDATE: Security researchers confirm active exploitation in the wild⁵. CVE-2025-55182, now widely known as “React2Shell,” has been integrated into Mirai and other botnet exploitation toolkits⁶. Nearly 50% of attacking IPs are newly registered infrastructure (December 2025)¹. Post-exploitation activities include cryptocurrency mining, credential theft, and ransomware deployment⁷. Five China-nexus APT groups (UNC6600, UNC6586, UNC6588, UNC6603, UNC6595) have been specifically attributed to this campaign⁵.

Today we witnessed defense in depth working exactly as intended. Within hours of CVE-2025-55182 being disclosed, a critical remote code execution vulnerability in React Server Components, we received alerts from two different sources:

Vercel’s dashboard, warning us that rules were already protecting our production deployment
Dependabot PR #87, automatically upgrading Next.js from 16.0.6 to 16.0.7

Vercel Dashboard Alert

This is what modern security infrastructure looks like: multiple layers working in concert. Vercel’s WAF provided immediate protection before we could even review the PR, while Dependabot delivered the actual patch for permanent remediation.

In this post, we’ll break down what CVE-2025-55182 is, why it matters, how these layered defenses protected our app, and what you should do to secure your own projects.

For Business Leaders

Your development teams need immediate support to upgrade. React2Shell poses the same threat level as Log4Shell with confirmed botnet integration and nation-state exploitation. Budget emergency patching cycles and engage your security team.

Vulnerability Overview: CVE-2025-55182 (React2Shell)

CVE-2025-55182, also known as “React2Shell” in the security community, is a critical-severity vulnerability affecting . Under certain conditions, specially crafted requests can lead to unintended on the server.

Technical Details:

Affected Packages: React 19’s server-side rendering packages (react-server-dom-parcel, react-server-dom-webpack, react-server-dom-turbopack)
Related CVE: CVE-2025-66478 for Next.js specifically
Impact: Remote code execution, environment access, infrastructure pivoting, data exfiltration

Affected Versions & Patches

Package	Affected Versions	Fixed Versions	Recommended (Jan 2026)
React	19.0.0 - 19.2.0	19.0.1, 19.1.2, 19.2.1+	19.2.3+ (all 4 CVEs fixed)
Next.js	≥14.3.0-canary.77, all 15.x, all 16.x	15.0.5+, 16.0.7+	16.0.10+ (latest hardened)

Other affected frameworks: Vite with RSC, Parcel, React Router (RSC), RedwoodSDK, Waku

Quick Version Check:

Bash

npm ls next react  # or check package.json

For Developers

Use Vercel's automated fix tool for fastest remediation: npx fix-react2shell-next. If self-hosting, deploy available WAF rules (Cloudflare, AWS WAF) while you test upgrades. Monitor for compromise using the detection patterns below.

View Fix Guide

Complete CVE Family (December 2025 Discoveries)

Following React2Shell’s disclosure, researchers discovered three additional vulnerabilities⁴:

CVE	Severity	Impact	Patched In
CVE-2025-55182	CRITICAL	Remote Code Execution	React 19.0.1+
CVE-2025-55183	MEDIUM	Source code exposure	React 19.2.2+
CVE-2025-55184	HIGH	Denial of Service	React 19.2.2+ (incomplete)
CVE-2025-67779	HIGH	DoS (bypass of CVE-2025-55184)	React 19.2.3+

Critical: CVE-2025-55184’s original fix was incomplete⁴. Upgrade directly to React 19.2.3+ to address all four vulnerabilities in one update⁸.

Share this section:

Timeline & Platform Response

Attack Chain Context: Exploitation is fully automated, progressing from scanner identification to payload deployment in under 10 seconds. Attackers use PowerShell arithmetic validation (powershell -c "40138*41979"), encoded payloads, AMSI bypasses, then deploy cryptocurrency miners, backdoors, and credential harvesters.

Here’s what makes this disclosure interesting from a DevSecOps perspective: Vercel’s platform detected and mitigated this vulnerability before Dependabot could even create a PR.

The disclosure and exploitation unfolded rapidly:

December 3, 2025 - Pre-disclosure: Vercel coordinates with the React team, develops WAF rules
December 3, 2025 - Public disclosure: CVE-2025-55182 and CVE-2025-66478 are published
December 3, 2025 - Immediate WAF deployment: Vercel automatically deploys protection rules
December 3, 2025 - 20:49 UTC - Same-day Dependabot PR: PR #87 arrives
December 3, 2025 - Within hours of disclosure: Initial exploitation attempts observed by AWS Threat Intelligence; China-nexus threat actors (Earth Lamia, Jackpot Panda) begin active exploitation⁹
December 3, 2025 - 22:00 UTC: First scanning activity detected globally across honeypots; sustained exploitation begins¹
December 4, 2025 - 21:04 UTC: Rapid7 validates weaponized exploit; proof-of-concept exploits become publicly available
December 5, 2025 - 06:00 UTC: Wiz Research sensors identify first victims compromised; rapid expansion of exploitation observed¹⁰
December 5, 2025 - Addition: CVE-2025-55182 added to CISA’s Known Exploited Vulnerabilities list³
December 5, 2025 - Lachlan Davidson : Original discoverer publishes official proof-of-concept; Metasploit exploit module available

Both systems worked, but with different roles and limitations:

Vercel’s WAF: Defense-in-depth layer (mitigation, not complete protection)
Dependabot: Same-day patch delivery (complete remediation)

Exploitation Tool Maturity

As of December 8, 2025:

Multiple working weaponized exploits publicly available
Metasploit module integrated into standard toolkit
Automated scanning tools widely adopted by threat actors
Payload variations observed as attackers refine techniques against real targets
High-fidelity exploitation with near 100% success rate reported by researchers

Vercel’s Approach

Vercel coordinated with the React team pre-disclosure, deployed WAF rules automatically to all projects, and continuously improved protections as bypass variants emerged. They released automated fix tooling (npx fix-react2shell-next) and began blocking new vulnerable deployments.

“We have created new WAF rules to address this vulnerability and deployed them to Vercel WAF that will automatically and at no cost protect all projects hosted on Vercel.” — Jimour Lai, Vercel Security Engineer

Important WAF Limitations: Vercel acknowledges that “WAF rules are one layer of defense but can never guarantee 100% coverage.” As new exploit variants emerged (evidenced by payload variations observed on December 8), Vercel identified and patched WAF bypasses, but upgrading remains the only complete fix.

CISA Recognition: The addition of CVE-2025-55182 to CISA’s Known Exploited Vulnerabilities list on December 5 signals that this is now considered a priority threat by federal agencies, underscoring the urgency of remediation.

This means that while the WAF provided valuable defense-in-depth, our production deployment wasn’t truly secure until we merged the upgrade. The WAF bought us time and reduced risk, but it wasn’t a substitute for patching.

The Broader Impact

Vercel also worked with the React team to provide recommendations to major WAF and CDN providers. This collaborative approach helps protect the broader ecosystem, not just Vercel customers.

Vercel’s $1 Million Bug Bounty Program

In an unprecedented security initiative, Vercel launched a $1 million bug bounty program specifically targeting WAF bypass techniques:

Program Results:

Engaged 116 security researchers to find every possible WAF bypass
Paid out over $1 million in bounties
Shipped 20 unique WAF updates within 48 hours as new bypass techniques were reported
All discovered bypass techniques are now permanent firewall additions

Dual-Layer Defense Architecture:

Vercel deployed a two-layer protection system:

Layer 1: Seawall WAF

Deep request inspection
Pattern-based exploit detection
Continuous updates from bug bounty findings

Layer 2: Runtime Mitigation (First Public Disclosure)

Operates directly on compute layer inside applications
Does not rely on heuristics
Directly eliminates code evaluation vector
covers 96% of Vercel traffic
Automatic alerting when triggered

This runtime layer provided visibility into actual WAF bypass attempts in production, allowing Vercel to state “with high confidence that the WAF was extraordinarily effective”—because they had ground truth data from the second layer.

Automated Remediation Tools:

Vercel Agent: Automatically detects vulnerable projects and opens PRs
npx fix-react2shell-next: One-command CLI fix tool

Share this section:

Threat Landscape: The Scale of React2Shell Exploitation

Attack Statistics (January 2026)

One month after disclosure, React2Shell has achieved unprecedented exploitation scale:

Volume Metrics:

8.1+ million attack sessions recorded since December 3, 2025¹
300,000-400,000 daily attacks currently sustained (not declining)¹
8,163 unique attacking IPs across 1,071 in 101 countries¹
644,000+ vulnerable domains still exposed (Shadowserver Foundation)²

Infrastructure Analysis:

50% of attacking IPs first observed after July 2025 (recent allocation)¹
AWS alone accounts for over one-third of exploitation traffic¹
Sophisticated coordination indicates organized threat actor campaigns⁵
Attack volume has stabilized but not declined—permanent fixture in attacker toolkits¹¹

Nation-State & APT Activity

Five China-nexus threat clusters have been specifically attributed (AWS + Google Threat Intelligence)⁵:

UNC6600 (Espionage): MINOCAT tunneler deployment with FRP client integration⁵
UNC6586, UNC6588, UNC6603, UNC6595: Multiple distinct clusters with custom tooling⁵
Earth Lamia (UNC5454) & Jackpot Panda: Active within hours of disclosure⁹
RondoDx botnet: Steadily expanding N-day vulnerability arsenal¹²

Advanced Tactics:

Automated scanning using commercial vulnerability scanners¹³
Metadata targeting (icon hashes, SSL certificates, geographic identifiers)¹³
Large-scale anonymization networks masking attribution⁵
Rapid weaponization of public PoCs (within hours)⁹
Simultaneous exploitation of multiple N-day vulnerabilities⁵

New Malware Families (Exclusive to React2Shell)

Security researchers have identified seven sophisticated malware families deployed specifically through CVE-2025-55182⁶:

Professional-Grade Tooling:

PeerBlight Linux Backdoor⁶

BitTorrent DHT network for C2 (domain-takedown resistant)
Node ID prefix “LOLlolLOL” for identification
Interactive shell, file exfiltration, configuration updates

Share this section:

Defense & Response: Multi-Layered Protection Strategy

Immediate Action Required: Upgrade Now

Even with cloud provider WAF protections, you must upgrade. WAF rules provide interim protection but are not a permanent fix.

For Security Teams

Implement detection for PowerShell Event ID 4104 AMSI bypasses, encoded commands, and unusual RSC POST patterns. Scan for .env credential theft, systemd persistence, and cryptocurrency mining. Five China-nexus APT groups are actively exploiting this vulnerability.

Detection Patterns

For Next.js Projects:

Bash

# Option 1: Use Vercel's automated fix tool (recommended)
npx fix-react2shell-next
 
# Option 2: Manual upgrade to latest patched versions
npm install next@latest react@latest react-dom@latest
 
# Option 3: Specify exact versions (January 2026 recommendations)
npm install next@16.0.10 react@19.2.3 react-dom@19.2.3

Verify Your Upgrade:

Bash

npm ls next react react-dom

For Other RSC Frameworks: Check framework documentation and ensure React 19.2.3+ (addresses all 4 ).

Vercel’s Unprecedented Defense Response

$1 Million Bug Bounty Program Results:

Engaged 116 security researchers to find WAF bypasses
Paid out over $1 million in bounties
Shipped 20 unique WAF updates within 48 hours
All bypass techniques now permanent firewall additions

Dual-Layer Defense Architecture:

Layer 1: Seawall WAF

Deep request inspection and pattern-based detection
Continuous updates from bug bounty findings
Automatic deployment across all Vercel projects

Layer 2: Runtime Mitigation (First Public Disclosure)

Operates directly inside applications on compute layer
Directly eliminates code evaluation vector
covers 96% of Vercel traffic with automatic alerting
Provides ground truth data on actual bypass attempts

Automated Remediation Tools:

Vercel Agent: Dashboard detection + automatic PR creation
npx fix-react2shell-next: One-command CLI fix tool

Industry-Wide WAF Protection

Automatically Deployed (No Action Required):

Vercel WAF: All Vercel-hosted projects
AWS WAF: AWSManagedRulesKnownBadInputsRuleSet v1.24+
Cloudflare WAF: React2Shell rules (December 3-4, 2025)
Google Cloud Armor: App Engine, Cloud Functions, Cloud Run

Available for Deployment:

Palo Alto Networks NGFW, Akamai WAF, Fastly WAF

Detection Tools & Enterprise Platforms

Open Source Scanners:

react2shell-scanner (Assetnote): github.com/assetnote/react2shell-scanner
npx fix-react2shell-next: Official Next.js remediation tool
Vercel Agent: Dashboard-based detection with automated PRs

Enterprise Security Platforms:

Microsoft Defender Vulnerability Management (MDVM)¹⁴
Microsoft Defender for Cloud (agentless scanning)¹⁴
Dynatrace Runtime Vulnerability Analytics¹⁵
JFrog Advanced Security¹⁶, Mondoo Security Platform⁸

Compromise Detection & Response

Signs of Active Exploitation:

Network Indicators:

Unusual POST requests with _prefix, _chunks, _formData patterns
Large encoded payloads, requests to uncommon RSC endpoints
Outbound connections to mining pools (ports 3333, 4444), domains

System Indicators:

PowerShell execution with -enc/-EncodedCommand flags
Windows Event ID 4104: bypass attempts (amsiInitFailed, AmsiUtils)
Base64-encoded command parameters, arithmetic validation commands

Temporary Mitigations (If Upgrade Delayed)

For Vercel Customers:

WAF provides partial protection (not complete)
Monitor dashboard for exploitation attempts
Plan upgrade as the highest priority

For Other Hosting:

Deploy available WAF (Cloudflare, AWS WAF, etc.)
Contact hosting provider for protection options
Consider taking applications offline until patched

Defense-in-Depth (NOT Complete Protection):

Block suspicious patterns at reverse proxy/load balancer
Implement strict input validation
Isolate affected applications from critical infrastructure
Monitor aggressively using detection patterns

Critical Reality Check: Active botnet exploitation means constant probing. Every hour of delay increases risk exponentially.

Long-Term Impact: The “Log4Shell of Frontend”

Security researchers are now comparing React2Shell to Log4Shell in terms of long-term impact and exploitation trajectory⁷:

Industry Impact Statistics

Wiz Research has provided comprehensive statistics on React2Shell’s impact¹⁰:

Vulnerability Exposure:

45% of cloud environments contain vulnerable React instances¹⁰
61% of Next.js deployments are publicly exposed to the Internet¹⁰
44% of all cloud environments have publicly exposed Next.js instances¹⁰
12% of cloud environments expose vulnerable React/Next.js directly to the Internet¹⁰

Key Parallels with Log4Shell

Similar Exploitation Velocity:

Weaponization within hours of public disclosure
Integration into standard attacker toolkits (Metasploit modules available December 5)
Automated scanning at massive scale (8.1M+ attack sessions)
Sustained attack volumes months after patches available

Ubiquitous Framework Creates Massive Attack Surface:

React is used by millions of applications globally
Next.js is the dominant React framework for production deployments
Cloud-native deployment patterns amplify exposure
Microservices architectures multiply vulnerable endpoints

Long-Tail Exploitation Expected:

VulnCheck assessment: “Likely to have a long tail” of exploitation¹¹
Daily attack volumes stabilized at 300k-400k (not declining as of January 2026)¹
Vulnerability permanently added to attacker reconnaissance playbooks¹¹
Organizations with slow patch cycles remain at risk indefinitely

Sustained Threat Trajectory

Unlike typical vulnerabilities that see exploitation decline after initial waves, React2Shell exhibits characteristics of permanent infrastructure risk:

Attack volume stabilization (not reduction) indicates systematic integration into attacker toolkits¹
New malware families continue to emerge (PeerBlight, CowTunnel, KSwapDoor identified in January 2026)⁶
Ransomware group adoption signals high-value target assessment and commercial exploitation⁷
APT group sustained interest suggests strategic intelligence value beyond opportunistic attacks⁵
644,000+ unpatched domains (as of January 2026) provide ongoing opportunities for exploitation²

Organizations should treat React2Shell as a persistent threat requiring ongoing vigilance, not a one-time patch event. The vulnerability’s integration into criminal infrastructure, nation-state operations, and automated exploitation frameworks ensures it will remain a significant risk factor for years to come.

Share this section:

What This Means for RSC Security

React Server Components represent a significant architectural shift. They blur the line between client and server code, which creates new attack surfaces that didn’t exist in traditional client-side React.

This vulnerability is a reminder that:

Server-side code needs server-side security thinking. RSC isn’t “just React”, it’s React running in a privileged environment.
Framework-level protections matter. Vercel’s ability to deploy WAF rules across their platform demonstrates the value of managed infrastructure.
The disclosure process is evolving. Coordinated disclosure with platform providers can protect users faster than traditional CVE → Dependabot → CI workflows.

Frequently Asked Questions

Key Takeaways

Upgrade immediately—this is under active exploitation: Botnet integration confirmed, mass scanning ongoing, post-exploitation includes cryptomining and ransomware staging
Use Vercel’s fix tool for fastest remediation: npx fix-react2shell-next automates the upgrade process
WAF protection is defense-in-depth, not a complete fix: WAF cannot guarantee 100% coverage; bypasses exist and new variants emerge
Monitor for compromise using the detection patterns: PowerShell Event ID 4104, encoded commands, AMSI bypasses, unusual network connections
Enable Dependabot security updates: Same-day PRs for critical vulnerabilities are invaluable (when you actually merge them)
RSC introduces server-side attack surfaces: React Server Components blur client/server boundaries, creating new security considerations
Expect long-term exploitation: This vulnerability will be part of the threat landscape indefinitely—unpatched systems will be found
Don’t test POCs on production: Use version checks and log analysis instead of running exploits

This incident highlights several important lessons for DevSecOps teams:

Defense in depth works: Vercel’s WAF and Dependabot provided layered protection
Automated tooling is essential: Automated fix tools and dependency management speed remediation
Proactive monitoring is critical: Detection patterns help identify potential compromises quickly
Collaboration matters: Coordinated disclosure with platform providers enhances ecosystem security

Acknowledgments

Credit: This vulnerability was responsibly disclosed by Lachlan Davidson. Thanks to Jimour Lai, Luba Kravchenko, and Andy Riancho at Vercel for the coordinated response.

Resources

GreyNoise. “CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild.” GreyNoise Intelligence, January 2026. greynoise.io; CyberSecurityNews. “Hackers Launched 8.1 Million Attack Sessions to React2Shell.” CyberSecurityNews, January 2026. cybersecuritynews.com

CVE-2025-55182 (React2Shell)

Stay in the loop

What did you think?

Comments

CVE-2025-55182 (React2Shell)

Stay in the loop

What did you think?

Comments

For Business Leaders

For Developers

Detailed Compromise Detection Indicators

Advanced Malware Analysis: PeerBlight & Professional Tooling

For Security Teams

Detailed Compromise Detection Indicators

Official Advisories

Vercel Resources

Additional Research & Analysis

Footnotes