A wave of React2Shell exploitation swept across the internet this week as attackers shifted from targeted reconnaissance to full-scale automated compromise. Security telemetry shows a rapid jump from hundreds of attacking hosts to tens of thousands, driven by botnets and public proof-of-concept tools. Researchers identified unsafe deserialization in React’s Flight protocol as the core flaw behind the surge. Despite patch availability, attackers continue to scan and breach unpatched environments running default configurations in popular JavaScript frameworks.
Relevant Source (CISA): Mitigating Log4Shell and Other Log4j-Related Vulnerabilities
CISA describes how the Log4Shell remote code execution flaw triggered rapid, widespread internet scanning and exploitation, mirroring how a critical bug in a popular component can quickly lead to large-scale automated attacks like React2Shell.
Quick Facts
- Attacks exploiting CVE-2025-55182 jumped from hundreds to nearly 77,000 exposed systems.
- Vulnerability enables unauthenticated remote code execution through React Server Components.
- Next.js, RedwoodJS and Vite RSC plugin deployments are heavily exposed.
- Botnets and mass-automation began exploiting the flaw starting December 5.
- Shadowserver and GreyNoise confirmed large spikes in malicious traffic.
- Patches for React and major frameworks are available and should be applied immediately.
React2Shell Vulnerability Basics
React2Shell refers to exploitation of CVE-2025-55182, a critical remote code execution flaw linked to unsafe deserialization inside React’s Flight protocol. The issue affects React Server Components and is widely present in default deployments across major frameworks. Many cloud environments rely on these components, which expands the attack surface significantly.
- Vulnerable setups allow attackers to send crafted Flight payloads that trigger server-side JavaScript execution.
- Public PoCs use a single HTTP POST request to compromise default Next.js 13 and 14 App Router installations.
- Prior analysis from Wiz Research shows 39 percent of cloud environments use affected React components.
Patches were released in early December, yet exploitation accelerated before many organizations updated their systems.
Relevant Source (Wiz Research): React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability
Wiz details how CVE-2025-55182 enables unauthenticated remote code execution via unsafe deserialization in React’s Flight protocol and quantifies its impact across cloud environments using React Server Components.
Why React2Shell Escalated Fast
The attack pattern shifted from targeted APT reconnaissance to large-scale automation within days. Botnets and new infrastructure now drive relentless scanning and exploitation against any exposed system. This shift raises the risk for small teams and cloud-heavy organizations that depend on default framework settings.
- Attacking IPs increased tenfold as automated tooling spread.
- GreyNoise confirmed multi-stage payloads including arithmetic probes and base64 downloaders.
- AMSI bypasses and evasion techniques are now embedded in the exploit chain.
- Shadowserver saw Next.js servers repurposed as attacking infrastructure.
- A Chrome extension found on GitHub performs opportunistic exploitation as users browse.
Systems that handle customer data or authentication workflows face the highest functional and operational impact.
Relevant Source (Cybersecurity Dive): State-linked groups target critical vulnerability in React Server Components
Cybersecurity Dive describes how state-linked actors and botnets rapidly moved from targeted exploitation to opportunistic, automated attacks against React2Shell, matching the observed spike in scanning and mass exploitation.
Immediate Mitigation Steps
Organizations should treat unpatched RSC deployments as actively targeted assets. Fast action reduces exposure since most attack traffic relies on scanning for default configuration weaknesses.
Steps to follow:
- Update react-server-dom packages to 19.0.1, 19.1.2, or 19.2.1.
- Upgrade Next.js to 16.0.7 or any current patched release.
- Apply filtering rules using GreyNoise blocklists.
- Monitor for PowerShell usage containing enc, DownloadString, IEX or AmsiUtils.
- Flag scripted arithmetic sequences used by attackers to confirm execution.
Closing exposure early limits the ability of automated campaigns to convert vulnerable systems into pivot points.
Relevant Source (Rapid7): React2Shell (CVE-2025-55182) – Critical Unauthenticated RCE Affecting React Server Components
Rapid7 outlines how CVE-2025-55182 is being actively exploited in the wild and stresses immediate patching and hardening actions, which aligns directly with the mitigation steps in this section.
Broader Impact On Cloud Security
React Server Components created a performance shift in the JavaScript ecosystem, but the architecture also expanded server-side complexity. This vulnerability highlights how deserialization logic can become a blind spot in popular frameworks that prioritize developer experience. Default configurations in Next.js, Vite and RedwoodJS made it easy for teams to deploy quickly, yet those same defaults widened the attack surface.
The rapid escalation from targeted APT reconnaissance to mass exploitation shows the speed at which public PoCs reshape threat activity. Attackers adapt instantly when frameworks are widely adopted and easily fingerprinted. Patching windows shrink under these conditions, and visibility gaps inside cloud environments allow compromises to propagate faster than many teams expect.
Relevant Source (Snyk): Critical RCE Vulnerabilities in React Server Components & Next.js
Snyk outlines how unsafe deserialization in React Server Components and default Next.js integrations created a widespread, easily exploitable attack surface, reinforcing the broader systemic risk described in this section.
Key Lessons For Defenders
Security teams can reduce the impact of React2Shell by updating quickly, tightening exposure and reviewing where React Server Components appear in production. The scale of automation behind recent attacks shows how dangerous default settings can be when paired with a remote code execution flaw.
Relevant Source (Australian Cyber Security Centre): Annual Cyber Threat Report 2024–25
This report highlights how groups like APT40 rapidly exploit newly disclosed vulnerabilities within hours or days of proof-of-concept release, reinforcing the need for fast patching and tighter exposure management.
FAQ
What systems are vulnerable?
Systems running unpatched React Server Components in frameworks like Next.js, RedwoodJS and Vite RSC plugin are at risk.
How is the attack executed?
Attackers send crafted Flight protocol payloads that trigger JavaScript execution on the server through unsafe deserialization.
Are patches available?
Yes. Updated react-server-dom packages and patched versions of Next.js have been released.
Why did attacks increase so fast?
Public PoCs, botnet adoption and automated scanning enabled large-scale exploitation soon after coordinated disclosure.
How can defenders detect active exploitation?
Look for suspicious PowerShell activity, AMSI bypass attempts, and unusual arithmetic commands used as execution probes.
How JENI Supports Secure And Stable Systems
Organizations dealing with fast-moving threats like React2Shell often struggle with hidden system issues that weaken performance and visibility. JENI keeps local machines stable which reduces the noise that attackers rely on to hide activity. Clean logs, repaired system components and consistent OS behavior help teams spot anomalies earlier. Security work becomes easier when the underlying machine is predictable and healthy.
What JENI Provides
- Deep local cleanup that removes clutter attackers often abuse
- System repairs that restore stable OS behavior across Mac and Windows
- Local, privacy-focused operation with no cloud processing
JENI fits into a broader defense strategy by keeping endpoints reliable enough for monitoring tools and analysts to trust the data they see. Strong patch hygiene and secure frameworks matter, but so does the system that runs them. Clean environments reduce false positives and prevent minor OS issues from turning into operational gaps. Stable endpoints give security teams a better foundation when responding to threats like React2Shell.
