Critical React2Shell Vulnerability (CVE-2025-55182) Analysis: Surge in Attacks Targeting RSC-Enabled Services Worldwide

In December 2025, CVE-2025-55182 (React2Shell) was publicly disclosed as a vulnerability in React Server Components that enables remote code execution without authentication. The flaw stems from a validation weakness in the deserialization of the Flight protocol used by RSC, affecting services that expose RSC and exposing a broad portion of the React ecosystem to automated attacks, with PoCs already available.

The official patch is in react-server-dom-* packages version 19.0.1 / 19.1.2 / 19.2.1 or later, and the vulnerability is rated CVSS 10.0, indicating critical severity. According to Criminal IP analysis, around 110,000 RSC-enabled assets in the United States are exposed, underscoring the substantial risk of widespread exploitation, though not all exposed assets are necessarily vulnerable.

According to CISA, the flaw has been added to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the urgency for organisations to review and apply patches across frameworks such as Next.js, Vite, Parcel, and RedwoodJS. The article also notes detection challenges and recommends immediate updates, verification across frameworks, minimising external exposure, and monitoring via Criminal IP to map and defend the attack surface.