Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

2.15M Next.js Web Services Exposed Online, Active Attacks Reported – Update Immediately

A critical vulnerability, CVE-2025-55182, identified in React Server Components (RSC), has prompted urgent action from security teams globally. Known as "React2Shell," this vulnerability has received a maximum CVSS score of 10, indicating severe impact…

EBy Eleanor TateDec 06, 20251 min read

A critical vulnerability, CVE-2025-55182, identified in React Server Components (RSC), has prompted urgent action from security teams globally. Known as "React2Shell," this vulnerability has received a maximum CVSS score of 10, indicating severe impact and ease of exploitation.

The flaw affects technologies including Next.js, Waku, React Router RSC, Vite RSC, Parcel RSC, and RedwoodSDK. According to Censys telemetry, over 2.15 million internet-facing services may be impacted.

The vulnerability arises from insecure deserialization of JSON payloads in React's server-side packages. An unauthenticated attacker can exploit this to execute arbitrary JavaScript on the server, resulting in potential remote code execution (RCE).

This vulnerability poses a threat even to applications that do not explicitly use Server Functions if they support RSC on the server side. Pure client-side React apps are not affected.

Threat actors have been observed exploiting this vulnerability within 24 hours of its public disclosure. CISA has added CVE-2025-55182 to its Known Exploited Vulnerabilities catalog, emphasizing its active use in attacks.

Public proof-of-concept exploits have been released, although some are malicious, requiring caution in handling exploit code.

A critical vulnerability, CVE-2025-55182, identified in React Server Components (RSC), has prompted urgent action from security teams globally.
Eleanor Tate · Thehackingpost

Affected React server packages include versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0:

react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack

Next.js (App Router) React Router RSC preview Waku Vite RSC plugin (@vitejs/plugin-rsc) Parcel RSC plugin (@parcel/rsc) RedwoodSDK

Next.js versions 14.3.0-canary.77 and later, all 15.x, and all 16.x using the App Router are considered vulnerable until patched.

Advertisement

React has released patched versions 19.0.1, 19.1.2, and 19.2.1. Next.js has also issued multiple fixes, including versions 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7. Cloudflare, AWS, and other providers have implemented WAF rules to block known exploit patterns, though these should be considered temporary measures.

Inventory all internet-facing assets using React Server Components, Next.js, or related frameworks. Verify package and framework versions, prioritizing publicly accessible systems. Upgrade to the latest patched releases and verify deployment.

Unpatched RSC-enabled services should be considered high risk until updated and assessed for compromise.

Based on reporting by GBHackers.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026