Microsoft Details Mitigations Against React2Shell RCE Vulnerability in React Server Components

Microsoft has issued detailed mitigations for a critical vulnerability identified as React2Shell (CVE-2025-55182), which significantly affects React Server Components and Next.js environments.

This vulnerability has been assigned a maximum CVSS score of 10.0. It is a pre-authentication remote code execution flaw that enables attackers to compromise servers using a single malicious HTTP request.

Initial exploitation attempts were recorded on December 5, 2025, targeting both Windows and Linux systems with high success rates.

The issue originates from the way React Server Components handle data using the Flight protocol. During client data requests, the server processes the payload to execute server-side logic. However, improper validation of inputs permits attackers to inject malicious structures accepted by the server as valid.

This vulnerability results in prototype pollution, allowing attackers to execute arbitrary code on the server.

Upon gaining initial access, attackers quickly establish persistence and increase their control over the network. The attack chain frequently involves deploying reverse shells that connect back to attacker-controlled Cobalt Strike servers, facilitating ongoing remote access.

Attackers often use remote monitoring and management tools like MeshAgent or modify system files to maintain access even after system reboots. They may employ bind mounts to conceal malicious processes from detection by system monitoring tools.

Analysis shows a variety of payloads delivered, including remote access trojans and cryptominers. Attackers also collect system details and environment variables to steal cloud identity tokens for Azure, AWS, and Google Cloud Platform, enabling lateral movement across cloud resources and amplifying the impact on affected organizations.

Based on reporting by Cyber Security News.