LimeByte

No. 05Security

React2Shell: critical vulnerability in React and Next.js

3 min read by LimeByte editorial team

React2Shell (CVE-2025-55182) allows attackers to execute code remotely. If you use React Server Components on the server, you should check and update immediately.

Contents 6

At LimeByte, we keep a constant eye on security developments in the web environment – not only for our own projects, but also for our clients. When critical risks emerge, we inform and act early so that damage does not occur in the first place. That is precisely why we would like to draw your attention today to a current threat that affects many web projects.

A newly discovered vulnerability in React Server Components (RSC) is currently causing great concern in the IT security community. Under the name React2Shell (CVE-2025-55182), it is already being actively exploited by cyber actors – according to AWS, these include state-sponsored groups from China. Its rating: CVSS 10.0 – maximum severity.

As React and Next.js in particular are among the most widely used web frameworks in the world, the threat level is correspondingly high. According to security experts at Wiz, around 39% of all cloud environments worldwide are potentially vulnerable as a result.

Why is the vulnerability so dangerous?

The flaw allows attackers to execute code on servers remotely and without authentication – a so-called remote code execution (RCE) attack. Particularly critical:

  • Exploitation is very easy
  • Mass scanning and attack waves are already under way
  • Proof-of-concept exploits have already been published
  • Compatible with common frameworks such as Next.js, Expo, React Router, Vite or Parcel

In short: every publicly accessible web application based on vulnerable React or Next.js versions is a potential target.

What is happening right now? – An attack wave is already under way

The vulnerability is already being actively exploited. Observed attacks include:

  • Installation of cryptominers
  • Building botnets
  • Deployment of persistent malware such as MeshCentral, EtherRAT or BPFDoor
  • Exfiltration of sensitive data and credentials
  • Further spread of the attack within compromised systems

Several security vendors, such as GreyNoise, Wiz, FortiGuard and Unit42, report sharply rising attack numbers and concrete indicators of compromise (IoCs).

Who is affected?

Affected packages and frameworks include the following:

  • react-server-dom-webpack / parcel / turbopack
  • React 19.0.0 – 19.2.0
  • Next.js 15.x and 16.x (partly with a separate CVE)
  • Various other frameworks that integrate RSC

Crucially: Not every React app is at risk — only those that use React Server Components on the server side.

However: many operators often do not know whether RSC has been enabled implicitly by a framework.

Patches are already available – immediate action is required

The following versions fix the vulnerability:

React

  • 19.0.1, 19.1.2, 19.2.1

Next.js

  • 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7
  • 16.0.7

Numerous other frameworks have also released hotfixes.

Important: a web application firewall (WAF) can help temporarily, but it is no substitute for an update.

How companies should respond now

1. Check immediately: am I affected?

Free tools for detection are available. Even if you think you do not use RSC, it is worth checking.

2. Patch as quickly as possible

Update all affected packages to the latest versions without delay.

3. Examine servers for compromise

There are currently concrete IoCs, including:

  • unusual POST requests with special headers (next-action, rsc-action-id)
  • $@ patterns in requests
  • execution of system commands such as whoami, uname, id
  • unexpected files in /tmp
  • new processes launched from within Node.js

Systems that were not patched immediately after disclosure in particular should be examined thoroughly.

4. Activate WAF rules (if available)

Many providers are already shipping protective rules – but only as a supplement to the patch.

5. Step up monitoring

According to all security analysts, targeted and opportunistic attacks will continue for weeks and months.

Conclusion

React2Shell is one of the most serious vulnerabilities of recent years – comparable to Log4Shell. Given the enormous popularity of React and Next.js, the threat to companies worldwide is real and acute.

For decision-makers, this means: take action immediately, have systems patched and search specifically for signs of compromise. Those who act quickly can avoid major damage – those who hesitate risk far-reaching attacks on critical systems.

Source: BSI