Critical RCE in React Server Components Under Active Exploitation
AI generate image of an engineer in shock to the React2Shell vulnerability
Photo by Perplexity Labs
Feel free to send us a message with your thoughts, or learn more about us!
STATUS UPDATE (December 13, 2025): Exploitation continues with confirmed China-nexus APT activity. Three additional CVEs disclosed (CVE-2025-55183, CVE-2025-55184, CVE-2025-67779). Latest patches: React 19.2.3 and Next.js 16.0.10+ address all vulnerabilities. Major cloud providers have deployed platform-level protections, but upgrade remains mandatory.
CRITICAL UPDATE (December 6, 2025): Security researchers confirm active exploitation in the wild. CVE-2025-55182, now widely known as “React2Shell,” has been integrated into Mirai and other botnet exploitation toolkits. Nearly 50% of attacking IPs are newly registered infrastructure (December 2025). Post-exploitation activities include cryptocurrency mining, credential theft, and ransomware staging.
Disclosure Notice: This vulnerability was publicly disclosed on December 3, 2025. If you’re running Next.js 14.3+, 15, or 16 with React Server Components, you should upgrade immediately, regardless of your hosting provider.
TL;DR:
Today we witnessed defense in depth working exactly as intended. Within hours of CVE-2025-55182 being disclosed, a critical remote code execution vulnerability in React Server Components, we received alerts from two different sources:
This is what modern security infrastructure looks like: multiple layers working in concert. Vercel’s WAF provided immediate protection before we could even review the PR, while Dependabot delivered the actual patch for permanent remediation.
In this post, we’ll break down what CVE-2025-55182 is, why it matters, how these layered defenses protected our app, and what you should do to secure your own projects.
CVE-2025-55182, also known as “React2Shell” in the security community, is a critical-severity vulnerability affecting React Server Components (RSC). Under certain conditions, specially crafted requests can lead to unintended remote code execution (RCE) on the server.
The vulnerability exists in React 19’s server-side rendering packages:
react-server-dom-parcelreact-server-dom-webpackreact-server-dom-turbopackFor Next.js specifically, there’s a related CVE: CVE-2025-66478.
RCE vulnerabilities are among the most severe security issues. An attacker exploiting this could potentially:
This isn’t a theoretical risk—it’s actively exploited in the wild with confirmed botnet integration.
If you’re using React Server Components with any of these versions, you’re affected:
| Package | Affected Versions | Fixed Versions | Recommended (Dec 13, 2025) |
|---|---|---|---|
| React | 19.0.0 - 19.2.0 | 19.0.1, 19.1.2, 19.2.1+ | 19.2.3+ (addresses all 4 CVEs) |
| Next.js | ≥14.3.0-canary.77, all 15.x, all 16.x | 15.0.5+, 16.0.7+ | 16.0.10+ (latest hardened) |
Other affected frameworks: Vite with RSC, Parcel, React Router (RSC), RedwoodSDK, Waku
Quick check for Next.js projects:
# Check your current versions
npm ls next react
# Or in your package.json
cat package.json | grep -E '"(next|react)"'Attack Chain Context: Exploitation is fully automated, progressing from scanner identification to payload deployment in under 10 seconds. Attackers use PowerShell arithmetic validation (powershell -c "40138*41979"), encoded payloads, AMSI bypasses, then deploy cryptocurrency miners, backdoors, and credential harvesters.
Here’s what makes this disclosure interesting from a DevSecOps perspective: Vercel’s platform detected and mitigated this vulnerability before Dependabot could even create a PR.
China-Nexus Groups (AWS Intelligence):
Wiz Research Findings:
Post-Exploitation Activity Observed:
The disclosure and exploitation unfolded rapidly:
Both systems worked, but with different roles and limitations:
As of December 8, 2025:
Vercel coordinated with the React team pre-disclosure, deployed WAF rules automatically to all projects, and continuously improved protections as bypass variants emerged. They released automated fix tooling (npx fix-react2shell-next) and began blocking new vulnerable deployments.
“We have created new WAF rules to address this vulnerability and deployed them to Vercel WAF that will automatically and at no cost protect all projects hosted on Vercel.” — Jimour Lai, Vercel Security Engineer
Important WAF Limitations: Vercel acknowledges that “WAF rules are one layer of defense but can never guarantee 100% coverage.” As new exploit variants emerged (evidenced by payload variations observed on December 8), Vercel identified and patched WAF bypasses, but upgrading remains the only complete fix.
CISA Recognition: The addition of CVE-2025-55182 to CISA’s Known Exploited Vulnerabilities list on December 5 signals that this is now considered a priority threat by federal agencies, underscoring the urgency of remediation.
This means that while the WAF provided valuable defense-in-depth, our production deployment wasn’t truly secure until we merged the upgrade. The WAF bought us time and reduced risk, but it wasn’t a substitute for patching.
Vercel also worked with the React team to provide recommendations to major WAF and CDN providers. This collaborative approach helps protect the broader ecosystem, not just Vercel customers.
Following the disclosure of React2Shell, security researchers discovered three additional vulnerabilities in React Server Components (December 11-13, 2025):
| CVE | Severity | Impact | Patched In |
|---|---|---|---|
| CVE-2025-55183 | Medium | Source code exposure | React 19.2.2+ |
| CVE-2025-55184 | High | Denial of Service | React 19.2.2+ |
| CVE-2025-67779 | High | DoS (incomplete CVE-2025-55184 fix) | React 19.2.3+ |
Recommendation: Upgrade directly to React 19.2.3 to address all four vulnerabilities in one update.
Google Threat Intelligence Group (GTIG) has identified multiple China-nexus threat clusters actively exploiting CVE-2025-55182:
New Malware Families Deployed:
Scale of Exploitation (December 5-13, 2025):
Google Cloud:
AWS:
Important: These platform protections are interim measures only. Patching vulnerable applications remains mandatory.
Even with cloud provider WAF protections, you must still upgrade. WAF rules provide interim protection but are not a permanent fix.
# Upgrade to the latest patched versions (December 13, 2025)
npm install next@latest react@latest react-dom@latest
# Or specify exact versions addressing all 4 CVEs
npm install next@16.0.10 react@19.2.3 react-dom@19.2.3After upgrading, confirm the versions:
npm ls next react react-domYou should see versions at or above the patched releases listed in the table above.
Check your framework’s documentation for specific upgrade instructions. The underlying fix is in React itself, so ensure you’re on React 19.0.1, 19.1.2, or 19.2.1+.
If you suspect your application may have been compromised, here’s how to investigate:
Monitor your systems for these indicators:
Unusual POST requests with patterns like:
_prefix, _chunks, _formData in request bodiesPowerShell execution (Windows servers):
-enc or -EncodedCommand flagspowershell -c "40138*41979")Windows Event Logs (Event ID 4104 - PowerShell Script Block Logging):
System.Management.Automation.AmsiUtilsamsiInitFailedNetwork indicators:
# Search for AMSI bypass attempts in PowerShell logs
Get-WinEvent -FilterHashtable @{
LogName='Microsoft-Windows-PowerShell/Operational'
Id=4104
} | Where-Object {
$_.Message -match 'amsiInitFailed' -or
$_.Message -match 'AmsiUtils' -or
$_.Message -match 'System.Management.Automation'
} |# Alert on suspicious encoded PowerShell with download patterns
Get-WinEvent -FilterHashtable @{
LogName='Microsoft-Windows-PowerShell/Operational'
Id=4104
} | Where-Object {
$_.Message -match '-enc' -and
($_.Message -match 'DownloadString' -or $_.Message -match 'IEX')
} # Search for unusual POST patterns in application logs
grep -E 'POST.*(_prefix|_chunks|_formData)' /var/log/app/*.log
# Check for PowerShell execution in function logs
grep -iE 'powershell|cmd\.exe|/bin/sh' /var/log/app/*.log
# Look for base64 patterns in request bodies
grep -E 'base64|[A-Za-z0-9+/]{50,}=' /var/log/app/*.log# Check for connections to known mining pools or exfiltration services
netstat -an | grep -E '(3333|4444|5555|8080|8443)'
# Review DNS queries for exfiltration domains
tcpdump -i any -n 'udp port 53' | grep -E '(ceye\.io|dnslog\.cn)'Verify your version (for Vercel customers):
next.versionAssume you’ve been scanned (if unpatched):
Review recent logs for the patterns above:
Check for post-exploitation indicators:
Block known malicious IPs:
Upgrade immediately:
Vercel provides additional detection assistance:
Remember: WAF protection is defense-in-depth, not a complete fix. Even if you see no exploitation attempts, upgrade immediately.
React Server Components represent a significant architectural shift. They blur the line between client and server code, which creates new attack surfaces that didn’t exist in traditional client-side React.
This vulnerability is a reminder that:
Server-side code needs server-side security thinking. RSC isn’t “just React”, it’s React running in a privileged environment.
Framework-level protections matter. Vercel’s ability to deploy WAF rules across their platform demonstrates the value of managed infrastructure.
The disclosure process is evolving. Coordinated disclosure with platform providers can protect users faster than traditional CVE→Dependabot→CI workflows.
After reviewing PR #87, we merged Dependabot’s upgrade from Next.js 16.0.6 to 16.0.7. Subsequently, we’ve received additional automated updates, bringing us to Next.js 16.0.10 and React 19.2.1 as of December 2025. Dependabot linked to the CVE, our CI validated each upgrade, and we deployed. Vercel’s WAF bought us time while Dependabot delivered the permanent fix—we weren’t scrambling, just approving the changes.
If you’re not using Dependabot or Renovate, here’s how to upgrade manually:
# Upgrade to the latest patched version
npm install next@latest react@latest react-dom@latest
# Or specify exact versions (December 2025 recommendations)
npm install next@16.0.10 react@19.2.1 react-dom@19.2.1Verify your upgrade:
npm ls next react react-domThis is why upgrading is non-negotiable.
npx fix-react2shell-next automates the upgrade processThis incident highlights several important lessons for DevSecOps teams:
Credit: This vulnerability was responsibly disclosed by Lachlan Davidson. Thanks to Jimour Lai, Luba Kravchenko, and Andy Riancho at Vercel for the coordinated response.
ceye.io, dnslog.cn, etc.)Function timeouts (weak indicator):
# Use Vercel's automated fix tool (recommended)
npx fix-react2shell-next
# Or manual upgrade
npm install next@latest react@latest react-dom@latestMonitor continuously: