React2Shell: A CVSS 10 Bug in React Server Components Is Exploited Within Days
From patch to CISA KEV listing took two days, and vulnerable internet-facing hosts fell by more than half in 48 hours.
Key takeaways
- CVE-2025-55182 scores CVSS 10.0 and needs no authentication; CISA listed it in KEV on December 5, 2025.
- Shadowserver counted about 77,000 vulnerable IPs on December 5; one tracker saw roughly 29,000 two days later.
- KEV additions rose about 20% in 2025 to 245, bringing the catalog to 1,484 entries.
A maximum-severity flaw in React Server Components, tracked as CVE-2025-55182 and nicknamed React2Shell, went from private report to confirmed in-the-wild exploitation in about a week. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on December 5, 2025, giving federal agencies until December 26 to fix it.
What happened
The React maintainers learned of the bug on November 29 from researcher Lachlan Davidson. Meta shipped patches on December 3. The flaw carries a CVSS score of 10.0 because an unauthenticated attacker can trigger it remotely with no special setup, leading to code execution on the server.
Affected systems are those using React 19 with Server Components, and the frameworks that bundle them: Next.js, Waku, React Router and RedwoodSDK. That reach is why defenders treated it as an ecosystem event rather than a single-product bug. AWS reported that at least two China-linked groups, Earth Lamia and Jackpot Panda, were exploiting it from December 3, the same day patches appeared. Palo Alto Networks' Unit 42 tied other activity to a cluster it tracks as CL-STA-1015, also known as UNC5174, which it describes as a suspected initial access broker linked to China's Ministry of State Security. One vendor found roughly 65% of attempts delivered Mirai malware or a cryptocurrency miner.
Patching fast, but not fast enough
Shadowserver counted more than 77,000 internet-facing IP addresses hosting vulnerable React instances on December 5. By December 7 a tracker cited by Vulert showed about 29,000. That is a drop of roughly 63% in two days, a respectable pace for a framework bug, yet the remaining hosts were left exposed while exploitation was already underway.
Why it matters
KEV has grown into the de facto priority list for patching. Cyble counted 245 additions in 2025 against 185 in 2024 and 187 in 2023, lifting the catalog to 1,484 entries. Of the new entries, 94 were flaws disclosed in 2024 or earlier, a reminder that old bugs keep getting used. React2Shell fits the pattern of the year: widely deployed software, a trivial trigger and exploitation measured in hours.
The practical lesson is dependency visibility. Many teams did not know which internal apps pulled in React Server Components through Next.js or another framework. Software bills of materials and runtime scanning shorten that discovery time.
What defenders did, and what they could not
The response illustrates both the strengths and limits of modern vulnerability management. On the strength side, coordination worked: the maintainers had a fix ready within days of the report, framework teams such as Next.js published advisories, and cloud providers pushed detections to customers. CISA's KEV listing converted a vendor advisory into a deadline for federal civilian agencies, which in practice also becomes a benchmark for private-sector patch teams who borrow the three-week window.
The limits are structural. Exploitation began the same day the patch appeared, which means attackers either had their own research or reverse-engineered the fix within hours. Any organisation relying on a monthly patch cycle was exposed for the entire period. Web application firewalls offered partial mitigation, but virtual patching is only as good as the rule set and cannot cover every framework variant. The exposure also hid in places security teams do not routinely inventory: build artefacts, container images and internal tools that bundle a framework deep in their dependency tree.
Practical steps recommended by responders were consistent. Identify every application using React 19 Server Components or one of the affected frameworks; update to the patched versions; check logs for unexpected processes launched by web server accounts; and rotate secrets on any host that looked compromised, since the attacker would have had code execution on the server. The payloads observed, Mirai variants and miners, are the low end of what a determined actor could deploy, and China-linked groups were reported by AWS to be using the flaw too, so assuming a cryptominer is the whole story would be a mistake.
The incident also feeds an ongoing debate about the supply chain around JavaScript frameworks. A single maintained library can sit under thousands of commercial products, each of which then has to ship its own fix. The gap between the upstream patch and the last downstream release is where most real-world exposure lives.
What to watch
- Whether further React or Next.js advisories follow, as researchers dig into the same component.
- If the remaining exposed hosts keep shrinking, or stall at a long tail of unmaintained apps.
- KEV growth in 2026 as AI-assisted bug finding increases the supply of exploitable flaws.
Sources
- Exploitation of React2Shell Surges — SecurityWeek
- React2Shell CISA KEV active exploitation — Vulert
- CISA KEV catalog expanded 20% in 2025, topping 1,480 entries — SecurityWeek
- CISA KEV 2025 exploited vulnerabilities growth — Cyble
