China-Nexus Hackers Actively Exploiting React2Shell Vulnerability (CVE-2025-55182) in the Wild
The React2Shell vulnerability, identified as CVE-2025-55182, has become a target for exploitation by China-nexus threat groups shortly after its public disclosure. This flaw affects React Server Components, allowing unauthorized code execution on the…
The React2Shell vulnerability, identified as CVE-2025-55182, has become a target for exploitation by China-nexus threat groups shortly after its public disclosure. This flaw affects React Server Components, allowing unauthorized code execution on the server.
The vulnerability impacts React 19.x and Next.js versions 15.x and 16.x when the App Router feature is enabled. Applications that support React Server Components are vulnerable, even if they do not directly call server actions.
Security experts have observed increased probing of internet-facing React and Next.js applications, particularly those handling critical cloud workloads. AWS security analysts detected active exploit attempts via their honeypot network, leading to the implementation of new defensive measures through Sonaris and updates to AWS WAF managed rules. These measures, however, do not replace the need for prompt patching by users on EC2, container, and on-premises hosts.
Field Detail
CVE CVE-2025-55182
Name React2Shell
CWE / Class Unsafe deserialization in React Server Components
This flaw affects React Server Components, allowing unauthorized code execution on the server.
Severity (CVSS) 10.0, critical
Affected stack React 19.x; Next.js 15.x, 16.x with App Router
Attack vector Remote, unauthenticated HTTP POST
Impact Remote code execution on the Node.js server
Key HTTP signs 'next-action', 'rsc-action-id', '$"@', "status":"resolved_model"
A typical React2Shell attack initiates with a crafted POST request targeting a React Server Components endpoint. The payload manipulates the unsafe deserialization process to inject JavaScript on the server. An example request is as follows:
'POST /_rsc HTTP/1.1' Host: victim.example Content-Type: application/json
{"next-action":"'$@'malicious_payload","status":"resolved_model"}
Upon successful deployment, the payload may execute shell commands, create files in /tmp , or establish new outbound connections from the Node.js process. Although many public exploits are ineffective, they contribute to log noise and can obscure functional exploit chains.
Security teams are advised to monitor for specific headers, patterns, and unusual child processes from Node.js to facilitate rapid detection and response.
Based on reporting by Cyber Security News.