Critical React2Shell Vulnerability Under Active Exploitation by Chinese Threat Actors

A critical vulnerability in React Server Components is allegedly being actively exploited by multiple Chinese threat actors, Recorded Future recommends organizations patch their systems immediately.

What's Happening

CVE-2025-55182, dubbed "React2Shell," affects React Server Components versions 19.0, 19.1.0, 19.1.1, and 19.2.0 in several Meta packages. Amazon's AWS Threat Intelligence team reported on December 4 that Chinese threat groups including Earth Lamia, Jackpot Panda, and several untracked clusters are actively exploiting this vulnerability. However, AWS has not provided any further evidence for these attributions beyond IP addresses allegedly used by these threat groups. At this stage, Insikt Group cannot exclude the possibility that the same threat group might still be using the IP address 206[.]237[.]3[.]150, but we are currently unable to verify AWS’s attribution to Earth Lamia.

The vulnerability stems from unsafe payload deserialization at React Server Function endpoints. When successfully exploited, attackers can execute arbitrary code through crafted HTTP requests, potentially leading to complete backend compromise.

CVE-2025-55182 (React2Shell) Intelligence Card®

The Scale of the Problem

According to Wiz Security's analysis, approximately 39% of scanned cloud environments contain vulnerable React instances. More concerning, their research shows that exploitation attempts have a near 100% success rate.

Beyond React Server Components, the vulnerability affects popular frameworks and libraries that bundle react-server, including:

Timeline of Events

The situation unfolded rapidly:

Who's Behind the Attacks

Recorded Future's Insikt Group has confirmed the involvement of at least one Chinese anonymization network in the exploitation activity. Specifically, they identified a compromised IP address functioning as a node in the GobRAT anonymization network, a tool assessed to be used exclusively by Chinese state-sponsored threat groups.

GobRAT infects hosts with malware that allows threat actors to launch attacks from compromised systems rather than their own infrastructure, providing additional operational anonymity.

Proof-of-Concept Exploits Available

Multiple proof-of-concept (PoC) exploits have been published demonstrating how to exploit CVE-2025-55182. The most credible comes from researcher Lachlan Davidson, who initially discovered and disclosed the vulnerability.

Davidson's PoC works by:

  1. Crafting an HTTP POST request with a JSON payload embedded as "multipart/form-data"
  2. Mimicking Server Action calls with specific headers
  3. Sending the request to Next.js or Waku RSC endpoints
  4. Triggering automatic deserialization that executes the malicious payload

While numerous additional PoCs have emerged since disclosure, both Davidson and AWS Security caution that many are of questionable quality and rely on unrealistic victim configurations in most React-based environments.

What You Need to Do Now

Organizations using React must act immediately:

1. Identify Vulnerable Assets

Determine whether your publicly accessible React-based applications are vulnerable using Assetnote's react2shell-scanner. You can also check locally by running:

npm run audit

If vulnerable, you should see a critical severity warning about Next.js RCE vulnerability.

2. Apply Patches Immediately

The React Team released patches for all affected versions:

Both React and Next.js have published detailed mitigation guidelines.

3. Block Malicious IP Addresses

Consider blocklisting the IP addresses identified in exploitation attempts:

Why This Matters

The combination of factors makes this vulnerability particularly dangerous:

Recorded Future Recommendations

Developers implementing React in their tech stacks are strongly advised to determine whether publicly accessible assets using React frameworks are currently vulnerable to CVE-2025-55182. The best way to currently scan for vulnerable assets is by using Assetnote’s react2shell-scanner; however, the tool is associated with false positives, so patching is necessary in instances where vulnerability is disputed. DataDog Security Labs also notes that the vulnerability can be identified locally by running the command “npm run audit,” which should respond with the following message if your current local version of React is vulnerable:

$ npm audit report

next  16.0.0-canary.0 - 16.0.6
Severity: critical
Next.js is vulnerable to RCE in React flight protocol - https://github.com/advisories/GHSA-9qr9-h5gf-34mp

Due to the responsible disclosure of CVE-2025-55182, a patch for all affected versions of React is available. Both React and Next.js have published mitigation guidelines to follow, which can be found here:

Given the severity and active exploitation, patching vulnerable React deployments should be treated as an urgent priority. The window between vulnerability disclosure and widespread exploitation continues to shrink, and threat actors are moving quickly to capitalize on unpatched systems.

Additionally, customers should consider deny-listing the IP addresses disclosed by AWS as involved in React2Shell exploitation.

Learn how to stay ahead of emerging threats. Understand all of the critical vulnerabilities that may be affecting your organization. Speak to our threat intelligence experts today.