React2Shell fallout spreads to sensitive targets as public exploits hit all
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) CVE-2025-55182 is a critical (CVSS 10.0) pre-authentication remote code execution flaw (CWE-502, deserialization of untrusted data) in React Server Components, specifically the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. It is triggered when the vulnerable code unsafely deserializes payloads from HTTP requests sent to Server Function endpoints, requiring no authentication or user interaction. An attacker gains arbitrary code execution on the affected server (CVSS scope changed, with high impact to confidentiality, integrity, and availability), and reporting notes a campaign in which hackers used the flaw to breach 766 Next.js hosts and steal credentials. Any React/Next.js application exposing Server Functions with the affected React versions is in scope, which given the ubiquity of React and Next.js is a very large deployed base. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-05 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.8%, multiple public PoC/scanner repositories are available, and coverage has dubbed the flaw React2Shell. Do: Upgrade the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages to the vendor-patched releases (any version later than the vulnerable 19.0.0, 19.1.0, 19.1.1, and 19.2.0 line) and update Next.js per Vercel's advisory; as a KEV entry, U.S. federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use. Audit internet-exposed Server Function endpoints for the vulnerable React versions and review logs for exploitation activity, including the reported campaign that breached 766 Next.js hosts and stole credentials, then rotate any exposed credentials. | 10.0 | 100% | KEV ransomware PoC ×7 |
| mass≈1M+ internet-facing Next.js/React Server Components deployments (order-of-magnitude estimate) | |
| CVE-2025-55183 | Unauthenticated source code exposure in React Server Components 19.x (incl. Next.js) CVE-2025-55183 is an information-disclosure flaw in specific configurations of React Server Components in versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, affecting the packages react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack. A specially crafted HTTP request sent to a vulnerable Server Function can cause it to unsafely return the source code of any Server Function, but only when the application has a Server Function that explicitly or implicitly exposes a stringified argument. An attacker gains unauthenticated read access to server-side application source code (CVSS 5.3, network-exploitable with no privileges or user interaction, confidentiality-only impact), which is valuable reconnaissance that can enable follow-on attacks alongside the related React RSC denial-of-service flaws. Affected are any applications running the listed React 19.x RSC packages, most prominently Next.js deployments that use React Server Components and Server Functions. A vendor advisory with public exploit guidance was published on December 11, 2025, reporting of 'React2Shell' fallout indicates public exploits are circulating, and EPSS assigns a 64.2% probability of exploitation within 30 days (99th percentile), though the flaw is not yet in CISA KEV. Do: Upgrade react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel to patched releases newer than the affected 19.0.0-19.2.1 versions, and update Next.js's bundled React accordingly, following the React team's December 11, 2025 advisory. Audit your application for Server Functions that explicitly or implicitly expose stringified arguments, since exploitation requires such a function to exist. Until patched, restrict and monitor external access to Server Function endpoints; no CISA KEV deadline applies yet. | 5.3 | 64% | PoC |
| massplausibly on the order of 100,000-1,000,000 sites and applications (vulnerable subset of the multi-million-site Next.js/React 19 RSC install base) | |
| CVE-2025-55184 | Unauthenticated Denial-of-Service in React Server Components 19.x and Next.js CVE-2025-55184 is a pre-authentication denial-of-service flaw in the deserialization logic of the React Server Components packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack in versions 19.0.0 through 19.2.1. An attacker triggers it by sending a crafted, unauthenticated HTTP request to any Server Function endpoint, where unsafe deserialization of the payload causes an infinite loop that hangs the server process. Successful attacks cause high availability impact: the affected process stops responding and subsequent HTTP requests are no longer served until the process is restarted, with no expected confidentiality or integrity loss. Any application using React 19 Server Components is affected, including Next.js deployments whose Server Functions rely on these packages. No public proof-of-concept or confirmed in-the-wild exploitation is known for this specific flaw, but the very high EPSS score (66.9% within 30 days, 99th percentile) and ongoing exploitation of related React RSC flaws (React2Shell) indicate elevated risk. Do: Inventory all applications using React 19 Server Components (react-server-dom-webpack, -turbopack, -parcel), including Next.js builds that bundle them, and upgrade to a React 19.x release newer than 19.2.1 with the patched packages as soon as available. As an interim mitigation, restrict and rate-limit access to Server Function endpoints and monitor or auto-restart server processes that hang under crafted requests. Prioritize patching given that related React RSC vulnerabilities are already being exploited in the wild. | 7.5 | 67% |
| masslikely hundreds of thousands to millions of Next.js/React RSC deployments, of which an unknown share exposes Server Function endpoints to the internet | ||
| CVE-2025-67779 | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served. NVD description · AI analysis pending | 7.5 | 20% |
| — |
Full article1,043 words · extracted from cyberscoop.com · click to collapse
Get our latest cybersecurity news first on Google.
Attacker interest in the vulnerability is magnified by an unparalleled number of publicly available exploits, earning the defect the highest verified public exploit count of any CVE ever.
Listen to this article
0:00
Learn more.
Fallout from React2Shell — a stubborn vulnerability that impacts wide swaths of the internet’s scaffolding — continues to spread as public exploits and stealth backdoors proliferate and worrying details emerge about the targets attackers are pursuing.
Threat researchers and incident responders are reacting to swift-moving developments on React2Shell with mounting concern. Cybercriminals, ransomware gangs and nation-state threat groups are all swarming to exploit the maximum-severity vulnerability.
Palo Alto Networks’ Unit 42 puts the latest victim count at more than 60 organizations, which have been impacted by attacks involving exploitation of CVE-2025-55182, which Meta and the React team publicly disclosed Dec. 3.
Microsoft said it found “several hundred machines across a diverse set of organizations” that were compromised via exploitation resulting in remote-code execution. Post-exploitation activity in those attacks includes reverse shell implants, lateral movement, data theft and steps that allowed attackers to maintain access to targeted networks, Microsoft said in a research blog Tuesday.
The full scope of attacker interest in the vulnerability is magnified by an unparalleled number of publicly available exploits — underscoring the relative ease and myriad ways unauthenticated attackers can trigger the defect to elevate privileges and pivot into other parts of targeted networks.
VulnCheck confirmed nearly 200 valid public exploits for React2Shell as of Thursday. “React2Shell CVE-2025-55182 now has the highest verified public exploit count of any CVE,” Caitlin Condon, vice president of research at VulnCheck, told CyberScoop.
Ongoing clean-up efforts for React2Shell also led to the discovery of three new defects affecting React Server Components last week, including CVE-2025-55183 and CVE-2025-67779, which fixes an apparent bypass for CVE-2025-55184, she said.
“The worst-case scenario on many defenders’ minds presently is that a true patch bypass for CVE-2025-55182 might arise. So far, this hasn’t come to pass,” Condon added.
Researchers continue to urge organizations to apply the patch for CVE-2025-55182, but note that the additional CVEs are not addressed in some early versions of the patch. And, of course, patching won’t evict attackers that already gained access to systems.
Attacks of different origins and motivations continue to spread globally.
Google Threat Intelligence said it has observed financially motivated attackers and at least five Chinese espionage threat groups exploiting the defect across multiple regions and industries. GTIG said it also identified attacks attributed to Iran, but it did not provide more information.
Amazon previously said its threat intelligence teams observed active exploitation attempts by Earth Lamia and Jackpot Panda within hours of the vulnerability’s public disclosure.
Cybersecurity firm S-RM said it responded to a ransomware attack Dec. 5 that involved React2Shell exploitation as an initial access vector. Attackers executed Weaxor ransomware within a minute of gaining access to the victim’s network, the company said in a blog post Tuesday.
Evidence of spiking malicious activity, including exploitation attempts, is showing up across the threat intelligence landscape.
Cloudflare said multiple Asia-based threat groups have been meticulous in targeting networks in Taiwan, the autonomous region of Xinjiang Uygur, Vietnam, Japan and New Zealand, yet other selective targets were observed, including U.S. government websites, academic research institutions and critical infrastructure operators.
“These infrastructure operators specifically included a national authority responsible for the import and export of uranium, rare metals and nuclear fuel,” Cloudflare’s threat intelligence team wrote in a blog post.
Several U.S.-based state and federal government agencies have been targeted, but there’s no confirmed exploitation, Blake Darché, head of threat intelligence at Cloudflare, told CyberScoop. The Cybersecurity and Infrastructure Security Agency declined to comment on attempted attacks against government agencies.
“Victimology has now evolved to be universal, with critical infrastructure targets just a small slice of all organizations and industries under attack,” Darché added.
While successful compromises are outside of GreyNoise’s visibility, malicious activity spotted by its sensors are continuing to pop off, according to Andrew Morris, the company’s founder and chief architect.
“Exploitation is still very high with the number of cumulative networks exploiting this vulnerability reaching all-time highs almost every single day since disclosure,” he wrote in a LinkedIn post Tuesday.
React2Shell has prompted widespread alarm in the two weeks since the vulnerability was first disclosed in the widely used application framework, and researchers expect the defect to have long-lasting impacts.
Austin Larsen, principal analyst at GTIG, said the critical vulnerability will likely be one of the more consequential defects it observed under active exploitation this year.
A debate that initially ensued in some industry circles over the seriousness and viable impact of the defect has effectively ended.
“Exploitation timelines are shrinking from weeks to hours,” Dan Perez, technology lead at GTIG, told CyberScoop. “Every new vulnerability presents a race against time. Every minute that a system remains unpatched is a minute that a threat actor can use to their advantage, which gives organizations a razor-thin margin for error.”
Latest Podcasts
Government
FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching
CIA’s Michael Ellis says cyber intelligence is changing how the agency operates
The G7 tells industry to hurry up and prep for post-quantum encryption
Jail time for Maine child in 764 marks turning point in federal law enforcement
Technology
Threats
Policy
Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots
‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help
Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities
Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure
Text extracted automatically; images, tables and formatting may be missing. Original: https://cyberscoop.com/react2shell-vulnerability-fallout-spreads/