Critical React2Shell Vulnerability (CVE-2025-55182 (CVSS 10.0)) Analysis: Surge in Attacks Targeting RSC-Enabled Services Worldwide

Estimated reading time: 5-6 minutes

Key Takeaways

  • React2Shell (CVE-2025-55182) is a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC) with a CVSS score of 10.0, actively exploited post-disclosure.
  • The flaw stems from a validation issue within the Flight protocol’s deserialization process, allowing unauthenticated RCE via specially crafted payloads.
  • It impacts the broader React ecosystem, including frameworks like Next.js, and necessitates immediate patching to react-server-dom-* packages (versions 19.0.1, 19.1.2, or 19.2.1 and later).
  • Detection is challenging for traditional tools; reliable identification uses specific HTTP response headers like Vary: RSC, Next-Router-State-Tree, revealing approximately 110,000 exposed assets in the United States alone.
  • Mitigation requires immediate package updates, framework-specific patch verification, minimizing RSC endpoint exposure, and leveraging advanced cyber threat intelligence platform solutions for continuous monitoring and breach detection.

Table of Contents

In December 2025, the cybersecurity community received notification of CVE-2025-55182, identified as React2Shell. This vulnerability within React Server Components (RSC) facilitates remote code execution (RCE) and has been classified with a CVSS score of 10.0, indicating critical severity. Shortly after its public disclosure, multiple security vendors reported an increase in scanning activities and suspected exploitation attempts against internet-facing assets. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) subsequently added CVE-2025-55182 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the immediate and severe threat posed by this flaw.

The React2Shell vulnerability is not confined to a single framework or application. Instead, it originates from a structural weakness inherent in the RSC feature itself, impacting the broader React ecosystem. This analysis delves into the technical underpinnings of React2Shell, evaluates the exposure landscape of services utilizing RSC, details observed attacker behaviors, and outlines strategic defensive measures organizations can implement to mitigate risk. Understanding this critical vulnerability is essential for maintaining robust security postures in environments that leverage React Server Components.

Critical React2Shell Vulnerability (CVE-2025-55182 (CVSS 10.0)) Analysis: Surge in Attacks Targeting RSC-Enabled Services Worldwide

The immediate aftermath of the CVE-2025-55182 disclosure saw a rapid increase in malicious activity. Threat actors quickly leveraged publicly available Proof-of-Concept (PoC) exploits, initiating automated attacks against vulnerable systems globally. This prompt exploitation highlights the critical importance of timely patching and proactive security measures. The widespread use of React and its associated frameworks means that the potential attack surface for React2Shell is substantial, demanding immediate attention from security teams and development operations.

React2Shell Vulnerability Overview: A Structural Flaw Allowing RCE Without Authentication

CVE-2025-55182 arises from a validation flaw within the deserialization process of the Flight protocol. This protocol is fundamental to how React Server Components manage state exchange between the server and client. The vulnerability permits an attacker to achieve RCE by dispatching a specially crafted payload to the Server Functions endpoint. Notably, this can be accomplished without requiring any prior authentication, significantly lowering the barrier for exploitation. The existence of a public PoC further exacerbates the risk, making the vulnerability highly susceptible to widespread, automated attacks by less sophisticated actors.

The repercussions of this flaw extend across all services that implement RSC. Frameworks such as Next.js, React Router RSC, Waku, Vite RSC Plugin, Parcel RSC Plugin, and RedwoodJS share the same underlying architectural structure related to RSC. Consequently, the entire React ecosystem faces collective exposure to this critical vulnerability. Developers and organizations leveraging these frameworks must recognize this interconnected risk.

The official patch for CVE-2025-55182 is available in react-server-dom-* packages, specifically versions 19.0.1, 19.1.2, or 19.2.1 and later. Given the CVSS score of 10.0, indicating maximum severity, immediate application of these patches is a top priority for all affected entities.

Exposure Analysis of React2Shell-Affected Assets

Identifying React2Shell-affected assets presents a challenge for traditional security tools. The vulnerability is difficult to detect using standard methods that rely on product banners or HTML content analysis. React-based services are architected such that RSC components are not typically exposed externally. Furthermore, frameworks like Next.js internally vendor React modules, complicating the identification of the underlying technology stack. Simple banner-based detection methods therefore cannot reliably ascertain whether RSC is enabled or if a given service is exposed to CVE-2025-55182.

In real-world operational environments, the most reliable method for detecting systems susceptible to React2Shell involves identifying them based on their HTTP response headers. Servers with RSC enabled consistently exhibit specific header values. For instance, a common pattern observed includes:

Vary: RSC, Next-Router-State-Tree

Specialized cyber threat intelligence platform solutions can leverage such specific header patterns to identify potentially vulnerable servers. Using a search query like "Vary: RSC, Next-Router-State-Tree" with an asset search platform can pinpoint RSC-enabled servers. When narrowed down to specific geographic regions, such as the United States, by adding country: "US", the scale of exposure becomes apparent.

According to recent asset search results utilizing this precise query, a total of 109,487 RSC-enabled assets were identified within the United States. This header pattern serves as a critical indicator that RSC is active on these servers. While the presence of this header does not automatically confirm that every single one of these assets is directly exploitable by CVE-2025-55182, it signifies a substantial exposure surface that requires thorough investigation and remediation. This data emphasizes the urgent need for comprehensive supply-chain risk monitoring across the React ecosystem, extending to all dependencies and deployed components.

Detailed analysis of specific assets reveals more about the potential attack vectors. For example, an identified server might have ports 80 and 443 exposed externally. A comprehensive security assessment, often provided by a cyber threat intelligence platform, would consolidate information such as response headers, SSL certificate details, identified vulnerability lists, and associations with Exploit Database entries onto a single page. In one such instance, indicators relevant to React2Shell were found alongside other critical vulnerabilities, including CVE-2023-44487 (HTTP/2 Rapid Reset), which has been extensively exploited in large-scale Distributed Denial of Service (DDoS) attacks. This multilayered analysis is crucial for accurately assessing the realistic exploitability of an environment and prioritizing defensive actions to prevent a potential breach detection scenario.

Security Mitigation Strategies and Practical Takeaways

Addressing CVE-2025-55182 requires a multi-faceted approach involving immediate technical updates, careful framework management, and continuous monitoring. These strategies are applicable to both technical teams responsible for implementation and business leaders overseeing organizational security posture.

1. Immediate Update of React-Related Packages:

Technical teams must prioritize the immediate update of all React-related packages to their latest patched releases. Specifically, the react-server-dom-webpack package must be upgraded to version 19.0.1, 19.1.2, or 19.2.1. Similarly, react-server-dom-parcel and react-server-dom-turbopack should be updated to version 19.0.1 or later. This ensures protection against the React2Shell vulnerability. Business leaders should ensure that resources are allocated for these critical updates, understanding the direct impact on organizational security.

2. Verify Patch Availability for Each Framework:

React Server Components are integrated across various frameworks, including Next.js, Vite, Parcel, and RedwoodJS. A critical detail is that Next.js vendors RSC internally. This means that merely updating generic React packages may not automatically apply the necessary fix within a Next.js application. Therefore, it is essential for technical teams to review each specific framework’s official security advisories and release notes. Verification of the exact version in which the CVE-2025-55182 vulnerability has been addressed for each framework in use is non-negotiable. Business leaders need to enforce a policy where patch verification is a mandatory step, not just a generic update. This is a key aspect of effective supply-chain risk monitoring.

3. Minimize External Exposure of RSC Endpoints:

Whenever feasible, restrict external access to RSC endpoints. This can be achieved through various perimeter security controls. Implementing a reverse proxy can filter incoming requests, while a Web Application Firewall (WAF) can detect and block malicious payloads targeting such vulnerabilities. Utilizing an authentication gateway further ensures that only authorized entities can access these sensitive endpoints, thereby minimizing the attack surface. This architectural decision can prevent unauthorized access even if an underlying vulnerability remains temporarily unpatched. For business leaders, this translates to investing in and properly configuring network security infrastructure.

4. Leverage Advanced Threat Intelligence for Monitoring:

Continuous monitoring is paramount, especially for critical vulnerabilities with public PoCs. Organizations should leverage advanced cyber threat intelligence platform solutions to:

  • Monitor Exposure of RSC-Related Headers: Continuously scan the organization’s public-facing assets for the presence of RSC-related HTTP response headers, such as "Vary: RSC, Next-Router-State-Tree". This provides breach detection capabilities before an active compromise.
  • Automatically Block Malicious Scanning IPs: Implement systems that identify and automatically block IP addresses engaged in scanning activities targeting known vulnerabilities. This proactive measure can prevent initial reconnaissance phases of an attack.
  • Detect Scanning Attempts Based on TLS Fingerprints: Analyze TLS handshake data for unique fingerprints associated with known vulnerability scanners or exploitation tools. This offers a more sophisticated detection method beyond simple IP blocking.
  • Check for Vulnerability Presence and Associated Exploit DB Entries: Utilize integrated cyber threat intelligence platform capabilities to cross-reference identified assets with known vulnerability databases and Exploit DB entries. This helps in understanding the real-time exploitability and prioritizing remediation efforts. PurpleOps also provides underground forum intelligence and dark web monitoring service capabilities, which are crucial for tracking early discussions about CVEs and the distribution of PoC exploits or attack methodologies. This includes telegram threat monitoring to detect emerging threats propagated through encrypted messaging platforms favored by threat actors.

The Analysis’s Conclusion

React2Shell (CVE-2025-55182) represents a critical vulnerability impacting a significant portion of the web ecosystem built on React-based services. Its low exploitation complexity, combined with the availability of public Proof-of-Concept exploits, facilitates rapid and widespread attacks. The identified exposure of approximately 110,000 RSC-enabled services in the United States alone, as demonstrated by targeted asset searches, underscores the substantial and immediate risk of extensive exploitation.

Effective response to React2Shell extends beyond merely applying patches. It necessitates a proactive approach that includes identifying exposed RSC services and implementing capabilities for real-time monitoring of potential attack attempts. This includes continuous supply-chain risk monitoring to track the security posture of all components within the development pipeline. PurpleOps provides comprehensive cyber threat intelligence platform capabilities that enable organizations to accurately map their attack surface and strengthen defensive measures against critical vulnerabilities such as CVE-2025-55182. Our dark web monitoring service and underground forum intelligence offerings are engineered to track early signs of exploitation and threat actor discussions, providing early warnings to clients.

For organizations seeking to enhance their security posture against vulnerabilities like React2Shell and other sophisticated cyber threats, PurpleOps offers a range of specialized services. Our cyber threat intelligence solutions provide actionable insights into emerging threats and attacker tactics. To assess and fortify your defenses, explore our penetration testing and red team operations services. For proactive protection against ransomware and other pervasive threats, learn more about how PurpleOps can protect ransomware incidents. Understand your overall security landscape with our supply-chain information security expertise, and gain visibility into external threats with our dark web monitoring and underground forum intelligence services.

Discover how PurpleOps can help secure your operations and mitigate complex cybersecurity risks. Visit our platform page or explore our comprehensive PurpleOps Solutions to learn more.

FAQ Section

What is React2Shell (CVE-2025-55182)?

React2Shell (CVE-2025-55182) is a critical remote code execution (RCE) vulnerability found in React Server Components (RSC). It allows attackers to execute arbitrary code on affected servers without prior authentication by sending specially crafted payloads.

What is the CVSS score of React2Shell?

The React2Shell vulnerability (CVE-2025-55182) has been classified with a CVSS score of 10.0, indicating maximum severity and highlighting the immediate and severe threat it poses.

How does React2Shell achieve RCE without authentication?

React2Shell exploits a validation flaw within the deserialization process of the Flight protocol, which is used by React Server Components. Attackers can dispatch a specially crafted payload to the Server Functions endpoint to achieve RCE, bypassing authentication mechanisms.

Which frameworks are affected by React2Shell?

The vulnerability impacts the broader React ecosystem, affecting frameworks that integrate React Server Components, including Next.js, React Router RSC, Waku, Vite RSC Plugin, Parcel RSC Plugin, and RedwoodJS.

How can I detect if my services are vulnerable to React2Shell?

Traditional security tools struggle with detection. The most reliable method involves identifying systems based on specific HTTP response headers, such as "Vary: RSC, Next-Router-State-Tree", which indicates RSC is enabled. Specialized cyber threat intelligence platform solutions can leverage these patterns.

What are the immediate mitigation steps for CVE-2025-55182?

Immediate steps include updating react-server-dom-* packages to versions 19.0.1, 19.1.2, or 19.2.1 and later, verifying patch availability for all specific frameworks in use, minimizing external exposure of RSC endpoints through perimeter controls, and leveraging advanced threat intelligence for continuous monitoring.

Why is supply-chain risk monitoring important for React2Shell?

Supply-chain risk monitoring is crucial because React2Shell affects the entire React ecosystem, including internally vendored modules in frameworks like Next.js. This means organizations must track the security posture of all components and dependencies to ensure comprehensive protection against such interconnected vulnerabilities.