2.15M Web Services Running Next.js Exposed Over Internet, Active Exploitation Underway – Patch Now
A critical unauthenticated remote code execution vulnerability, named "React2Shell," is currently being exploited, posing significant risks to millions of web services.
A critical unauthenticated remote code execution vulnerability, named "React2Shell," is currently being exploited, posing significant risks to millions of web services.
On December 3, a critical flaw, CVE-2025-55182, was disclosed in React Server Components, carrying a CVSS score of 10. The vulnerability arises from insecure deserialization in the "Flight" protocol used by these components.
Attackers can execute arbitrary code on vulnerable servers by sending specially crafted HTTP requests to Server Function endpoints without requiring authentication, potentially gaining complete control over affected systems.
Active Exploitation by State-Sponsored Groups
Amazon Web Services researchers have identified that threat actors, including groups with China nexus such as Earth Lamia and Jackpot Panda, began exploiting this vulnerability within 24 hours of its public disclosure. These actors target cloud-hosted applications using React Server Components, deploying web shells and backdoors shortly after gaining access.
Field Details
CVE-ID CVE-2025-55182
On December 3, a critical flaw, CVE-2025-55182, was disclosed in React Server Components, carrying a CVSS score of 10.
CVSS Score 10.0 (Critical)
Vulnerability Type Unauthenticated Remote Code Execution
Affected Versions React 19.0.0, 19.1.0, 19.1.1, 19.2.0
As of December 5, CISA has included CVE-2025-55182 in its Known Exploited Vulnerabilities Catalog, highlighting the flaw's severity and active exploitation. GreyNoise has documented opportunistic exploitation attempts, indicating widespread scanning and exploitation activity online.
Approximately 2.15 million internet-facing web services may be affected, according to Censys. These services include those running React Server Components and related frameworks such as Next.js, Waku, React Router, and RedwoodSDK.
The vulnerability impacts React Server Components packages, including react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, in versions 19.0.0 through 19.2.0. Popular frameworks such as Next.js versions 14.3.0-canary.77 and above, React Router RSC preview, Waku, Vite RSC Plugin, Parcel RSC Plugin, and RedwoodSDK rely on these packages.
Applications that exclusively use client-side React are not affected. However, those implementing React Server Components remain vulnerable, even if they do not explicitly use Server Function endpoints.
Fixed versions are available. It is advised that organizations update to React 19.0.1, 19.1.2, or 19.2.1. Next.js users should upgrade to the appropriate versions: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, or 16.0.7.
While some Web Application Firewall providers, including Cloudflare and AWS, have implemented protective rule sets, patching remains the most reliable mitigation strategy, given the active exploitation, maximum severity score, and widespread framework adoption. Organizations using React Server Components should prioritize this patch as an emergency.
Based on reporting by Cyber Security News.