Exploit Attempts Surge for React2Shell

Hacker interest is high in a days-old vulnerability in widely used web application framework React, with dozens of organizations already falling victim to it, cybersecurity experts warn.

See Also: Top 10 Technical Predictions for 2025

A security researcher late Thursday released a working, weaponized exploit for the pre-authentication remote code execution vulnerability that affects React Server Components, after which experts tracked a surge in scanning and targeting activity (see: Chinese Nation-State Groups Tied to ‘React2Shell’ Targeting).

React is used by an estimated two-fifths of the world’s top 10,000 websites, including Airbnb, Meta, Netflix, Shopify and Uber. It’s used in mission-critical enterprise applications and e-commerce platforms.

Tracked as CVE-2025-55182, the “React2Shell” vulnerability affects all versions of the Meta-developed open-source React framework since version 19, released in November 2024. Also affected are related frameworks that use the affected webpack, parcel and turbopack packages. This includes the file-system-based App Router in the Next.js framework versions 15.x and 16.x. Next.js initially tracked its React vulnerability as CVE-2025-66478 but the CVE program rejected the designation as a duplicative.

“Pre-authentication remote code execution vulnerabilities represent the crown jewels of attacker toolkits,” giving them the ability to steal data, harvest credentials, move laterally through infrastructure and unleash ransomware, warned cybersecurity firm Trend Micro.

“The attack complexity is low,” owing to attackers being able to trigger the vulnerability without having to authenticate, meaning “it requires no user interaction and no privileges,” Unit 42 said.

The U.S. Cybersecurity and Infrastructure Security Agency on Friday added CVE-2025-55182 to its known exploited vulnerabilities catalog, setting a Dec. 26 deadline for civilian federal agencies to either patch the product or discontinue its use.

Scans by the Shadowserver Foundation on Friday counted nearly 77,700 servers vulnerable to CVE-2025-55182, with 23,700 in the United States, 9,400 in Germany and more than 4,000 each in France, India and China. “Like others we are seeing attacks attempting to exploit React CVE-2025-55182 at scale, including botnet-related activity,” Shadowserver said.

By Saturday, attackers targeting the vulnerability managed to compromise at least 30 organizations, Unit 42 told BleepingComputer, which reported that attackers were exploiting the vulnerability “to run commands, conduct reconnaissance and attempt to steal AWS configuration and credential files.”

Coordinated Disclosure Process

The vulnerability was first discovered by New Zealand-based cybersecurity consultant Lachlan Davidson, who privately reported it through the Meta Bug Bounty program on Nov. 29.

Meta’s security researchers on Nov. 30 began working with Vercel – a Next.js backer that helps steer development of React – to create a fix, which they began rolling out to hosting providers on Dec. 1.

The first public alert about the flaw and its CVE happened two days later, at the same time that a fix for the vulnerabilities was published to the Node Package Manager JavaScript, Node.js, maintained by GitHub subsidiary npm.

Threat intelligence researchers at Amazon Web Services reported that “within hours” of the flaw’s public disclosure, they saw attackers attempting to exploit the vulnerability. Many of these attacks they attributed to multiple Chinese cyberespionage hacking teams, including threat actors tracked as Earth Lamia and Jackpot Panda.

Palo Alto told BleepingComputer that some of the attacks resulted in systems being infected by the remote access Trojan VShell as well as memory-based Snowlight malware, as previously used by a threat actor tracked as UNC5174. That codename is Google Mandiant’s designation for what it describes as being an individual who sells initial access to hacked sites to China’s Ministry of State Security (see: Likely Chinese Hacking Contractor Is Quick to Exploit N-Days).

AWS said the exploit is also being targeted by “large-scale anonymization networks,” of the type that get regularly used by for “Chinese cyber operations, enabling reconnaissance, exploitation and command-and-control activities while obscuring attribution” since multiple groups appear to share these networks.

Numerous purported exploits for the flaw began circulating following the Wednesday security alert, although researchers said they appeared to be either misguided or AI-generated slop.

That changed late Thursday, when the first working proof-of-concept exploit debuted, after which Davidson and others released their own PoCs. The open-source Metasploit penetration testing framework on Friday published a module designed to exploit the vulnerability.

Some Protection From WAFs

Not all React-using organizations are at risk. Researchers at SearchLight cyber published an HTTP request “that can be used to safely and confidently confirm the presence of this RCE vulnerability in Next.js applications,” based on the response it returns.

“While there are several mechanisms to determine whether an asset is running React Server Components, simply verifying that RSC is present is not a high-enough signal to determine whether an asset is truly vulnerable to this RCE,” it said.

Cloud services firms have urged anyone using a vulnerable instance to update, and have been adding rules to their web application firewalls to try and buy them time to patch.

Amazon said its AWS web application firewall default version 1.24 now includes a rule designed to detect and block attempts to exploit the vulnerability. “These protections are not substitutes for patching,” AWS warned.

Google Cloud also issued a new rule for its Cloud Armor WAF designed to detect and block CVE-2025-55182 exploitation attempts “We recommend deploying this rule as a temporary mitigation while your vulnerability management program patches and verifies all vulnerable instances in your environment,” it said.

Cloudflare added a new WAF rule that’s enabled by default, leading to the firm suffering widespread but temporary outages on Friday, which it ascribed to those changes.

Security researchers continue to find and report ways of bypassing these WAF rules. They’ve warned that attackers may also be finding bypasses, adding urgency for all at-risk React and Next.js users to patch.