Critical CVE in React Server Components Actively Exploited
Summary
Aqua Nautilus reports active exploitation of CVE-2025-55182 (React2Shell), an unauthenticated insecure-deserialization vulnerability in React Server Components that can enable remote code execution and full server compromise. AWS reportedly observed China-nexus groups exploiting it, while GreyNoise reported widespread opportunistic scanning. The article recommends upgrading affected React and Next.js versions and applying scanning and runtime controls.
Key points
- The flaw affects React Server Components in vulnerable React versions 19.0.0–19.2.0 and applications using vulnerable RSC integrations, including Next.js.
- A malicious HTTP request can supply attacker-controlled data to the RSC deserializer, potentially enabling arbitrary server-side code execution without authentication.
- Aqua reports that AWS observed China-nexus threat groups scanning and exploiting the vulnerability, while GreyNoise observed widespread botnet and opportunistic exploitation activity.
- Reported post-exploitation attempts include deploying remote shells or cryptominers, harvesting environment-variable credentials, modifying files, establishing persistence, and seeking lateral movement.
- The article lists React patched versions 19.0.1, 19.1.2, and 19.2.1, and Next.js patched versions 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7.
- Defensive guidance includes auditing direct and transitive dependencies, rescanning images and workloads, upgrading to patched releases, and applying runtime controls.
Attack Vectors
- Unauthenticated malicious HTTP request exploiting insecure deserialization of attacker-controlled React Server Components metadata.
Defensive Notes
- Review direct and transitive dependencies for affected React and related packages, and upgrade to the patched versions listed in the article.
- Rescan images, pipelines, and workloads; use runtime controls to block unapproved packages, code-injection behavior, and suspicious activity.
Tags
VulnerabilityRemote Code ExecutionActive ExploitationInsecure DeserializationCloud SecuritySupply Chain Attacks