Chinese Nation-State Groups Tied to ‘React2Shell’ Targeting

Warnings intensified over a critical vulnerability in the widely used web application framework React following the public release of a weaponized exploit for the flaw.

See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments

Tracked as CVE-2025-55182, the “React2Shell” vulnerability affects all versions of the Meta-developed open-source React framework since version 19, released in November 2024. All frameworks that use the affected packages, including the file-system-based App Router in the Next.js framework versions 15.x and 16.x, are vulnerable (see: Breach Roundup: React Flaw Incites Supply Chain Risk).

Hackers already appear to be exploiting the flaw, which allows full remote code execution. Amazon Web Services warned that “within hours” of the flaw’s public disclosure Wednesday, it “observed active exploitation attempts by multiple China state-nexus threat groups,” including threat actors tracked as Earth Lamia and Jackpot Panda. Researchers have tied those groups to cyberespionage operations focusing on Asian targets.

“Opportunistic, largely automated exploitation attempts” based on working proof-of-exploit code surged on Friday,” reported threat intelligence firm GreyNoise.*

The firm said that while at least some of this activity likely traces to researchers and automated scanners, the exposed React services “are easy to find and exploit at scale,” and that this type of mass scanning can quickly graduate to “credential theft, cryptomining, ransomware staging or access-broker resale.”*

The vulnerability, which carries a maximum CVSS score of 10.0, can be remotely exploited using HTTP, without needing to authenticate.

The React framework is widely used, with cybersecurity firm Wiz observing vulnerable versions of Next.js or React running across 39% of all cloud instances.

Organizations that use React or any “affected downstream frameworks” should “remediate this vulnerability on an urgent basis, outside of normal patch cycles and before broad exploitation begins,” said cybersecurity firm Rapid7.

The vulnerability poses “significant enterprise and supply chain risk given React’s ubiquity: the impacted JavaScript library underpins modern UIs, with 168,640 dependents and more than 51 million weekly downloads,” said Flashpoint.

The AWS exploitation alert followed the release of multiple proof-of-concept exploits that independent security researchers tested and found to be bogus. That changed late Thursday, when security researcher @maple3142 on GitHub posted a proof-of-concept exploit for CVE-2025-55182 “that works on Next.js 16.0.6.”

Multiple researchers have validated that this POC exploit works, notably including Lachlan Davidson. He first reported the vulnerability privately to social media giant Meta on Saturday. On Wednesday, React and Vercel, which develops Next.js, issued security alerts. Davidson on Friday published his own POC exploit.

The flaw has been tracked as CVE-2025-55182 for React and CVE-2025-66478 for Next.js, but Mitre, the organization behind the vulnerability enumeration system, rejected the second CVE as duplicative.

The logical deserialization vulnerability results from the React Server Components package handling input in an unsafe way. “When a server receives a specially crafted, malformed payload, it fails to validate the structure correctly. This allows for attacker-controlled data to influence server-side execution logic, resulting in the execution of privileged JavaScript code,” Wiz said.

Cloud services giants appear to be scrambling to get fixes in place, with Cloudflare reporting outages Friday that it tied to React updates.

“A change made to how Cloudflare’s Web Application Firewall parses requests caused Cloudflare’s network to be unavailable for several minutes this morning,” the content delivery network giant said. “This was not an attack; the change was deployed by our team to help mitigate the industry-wide vulnerability disclosed this week in React Server Components.”

Not everyone who uses React, Next.js or other downstream frameworks is at risk, with that combination of the latest version of React and Next.js, plus the use of RSC, remaining “a niche setup,” said British researcher Kevin Beaumont in a blog post urging the security community to collectively “calm down” and avoid overreacting.

“Check with your developers and suppliers if they even use React v19 yet. They most probably don’t, in which case you aren’t vulnerable,” he said.

*Update Dec. 5, 2025 15:25 UTC: Adds GreyNoise research.