React2Shell Vulnerability Hit by 8.1 Million Attack Attempts

The React Server Components (RSC) "Flight" protocol remote code execution vulnerability, identified as CVE-2025-55182 and commonly known as "React2Shell," is currently being targeted in a large-scale exploitation campaign.

Since its disclosure, over 8.1 million attack sessions have been recorded, with daily attack volumes stabilizing between 300,000 and 400,000, following a peak above 430,000 in late December 2025.

This vulnerability impacts React, Next.js, and several other frameworks utilizing the RSC Flight protocol. The technology is a high-value target as it interfaces directly with application logic often operating with production-level permissions.

The exploitation effort involves 8,163 unique source IP addresses across 1,071 autonomous system numbers (ASNs) in 101 countries. This diversity indicates wide adoption by various threat actor groups.

Amazon Web Services accounts for over one-third of the observed exploitation traffic, with the top 15 ASNs comprising approximately 60% of source IPs, highlighting the use of cloud infrastructure for such campaigns.

The campaign has generated over 70,000 unique payloads, showing continuous adaptation by attackers. There are 700 distinct JA4H hashes (HTTP client fingerprints) and 340 unique JA4T hashes (TCP stack fingerprints), indicating varied tooling and automation frameworks in use.

Initial attacks use simple PowerShell arithmetic operations for proof-of-execution (PoE). Successful executions lead to the deployment of encoded PowerShell stagers using "-enc" obfuscation and "DownloadString" for further payload retrieval.

Stage-two payloads include anti-malware bypass techniques targeting Windows AMSI (Antimalware Scan Interface), reflecting common exploitation practices. Approximately 50% of exploitation IPs were first detected after July 2025, showing reliance on newly provisioned infrastructure and rapid IP rotation.

Organizations should prioritize patching React and Next.js deployments. Network defenders are advised to use dynamic blocklists targeting identified exploitation sources, as static IP-based blocking is insufficient.

Defenders should monitor for process creation events involving PowerShell execution with encoded commands, "DownloadString" functionality, or AMSI bypass patterns. PowerShell script block logging (Windows Event ID 4104) should be configured to alert on suspicious activity involving System.Management.Automation.AmsiUtils.

Rapid patching and effective endpoint detection can help contain this threat in its initial opportunistic phase.

Based on reporting by GBHackers.