Microsoft Outlines Mitigation for React2Shell RCE Vulnerability in React Server Components
Microsoft has issued guidance on CVE-2025-55182, a critical pre-authentication remote code execution (RCE) vulnerability affecting React Server Components and the Next.js framework.
Microsoft has issued guidance on CVE-2025-55182, a critical pre-authentication remote code execution (RCE) vulnerability affecting React Server Components and the Next.js framework.
This vulnerability, with a CVSS score of 10.0, allows arbitrary code execution on vulnerable servers via a single HTTP request, posing significant risk to React-based web applications.
CVE-2025-55182, also known as React2Shell, targets the Flight protocol used by React Server Components for client-server communication. The issue arises from insufficient payload validation, enabling attackers to inject structures that lead to prototype pollution and RCE.
Active exploitation was detected starting Dec 5, 2025, with attackers compromising numerous systems across various organizations, often deploying cryptocurrency miners on both Windows and Linux.
Microsoft Defender telemetry shows that attackers send crafted POST requests with malicious serialized objects to React Server Component applications. This input executes under NodeJS runtime due to default component trust mechanisms.
Post-exploitation activities include establishing reverse shell connections, deploying malware such as VShell, EtherRAT, SNOWLIGHT, ShadowPAD, and XMRig cryptominers, and using evasion techniques to hide processes.
CVE-2025-55182, also known as React2Shell, targets the Flight protocol used by React Server Components for client-server communication.
Credential theft operations target Azure, AWS, Google Cloud Platform, and Tencent Cloud endpoints to acquire identity tokens for lateral movement. There have been attempts to harvest AI and cloud-native credentials, including OpenAI API keys and Kubernetes service-account credentials.
Microsoft advises immediate action to address affected packages such as react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack, and next. Affected versions include React 19.0.0 to 19.2.0 and Next.js 14.3.0-canary.77 to 16.0.6.
Organizations should prioritize patching internet-facing services by upgrading to patched versions: React 19.0.1, 19.1.2, 19.2.1, and Next.js 15.0.5 to 16.0.7.
Microsoft Defender Vulnerability Management aids in identifying vulnerable packages and tracking remediation. For cloud environments, Microsoft Defender for Cloud provides templates to locate vulnerable containers and VMs.
Azure Web Application Firewall (WAF) custom rules can block exploit patterns as a temporary control. Microsoft provides rule guidance and JSON examples in the Azure Network Security Blog.
Organizations should enable Microsoft Defender alerts for exploitation attempts and correlate signals for threat triage. Microsoft Defender XDR offers detection frameworks and attack disruption capabilities across operating systems.
Microsoft Defender for Cloud supports agentless scanning for vulnerable containers and cloud VMs. Microsoft Security Exposure Management provides automated attack path analysis to identify exposed resources and potential compromise routes across cloud platforms.
Based on reporting by GBHackers.