Exploitation of React2Shell Surges

Exploitation of React2Shell has surged as more threat actors attempt to exploit the critical React vulnerability CVE-2025-55182, which can enable unauthenticated remote code execution via specially crafted HTTP requests in React version 19 with Server Components. Patches were released by React on 3 December after learning of the issue on 29 November from researcher Lachlan Davidson, and the vulnerability also affects other frameworks such as Next.js, Waku, React Router, and RedwoodSDK.

The Shadowserver Foundation reported more than 77,000 IPs hosting vulnerable React instances, while CISA has confirmed exploitation and added CVE-2025-55182 to its Known Exploited Vulnerabilities catalog with a completion deadline of 26 December for agencies.

AWS has said at least two known China-linked threat actors, Earth Lamia and Jackpot Panda, have been exploiting it since 3 December, with multiple organisations affected across sectors and Wiz noting 39% of monitored cloud environments contain vulnerable React or Next.js versions. Observed activity includes scanning for vulnerable RCE, credential theft attempts, and the deployment of downloaders, with GreyNoise recording exploitation attempts from over 200 IP addresses in the past two days. Written by Eduard Kovacs.