“React2Shell” Crisis: Critical Vulnerability Triggers Global Cyberattacks by State-Sponsored Groups

On 11 December 2025, security site coverage flagged a critical flaw in the React ecosystem, dubbed “React2Shell” (CVE-2025-55182) with a maximum CVSS score of 10.0, enabling unauthenticated full control of servers. Unit 42 researchers at Palo Alto Networks have observed post-exploitation activity linking attacks to North Korean and Chinese state-nexus groups pivoting from reconnaissance to full-scale compromise.

The vulnerability lies in the Flight protocol used by React Server Components and Next.js, described as an insecure deserialization bug where the server trusts data sent by the attacker. The world’s most dangerous threat actors are reportedly exploiting the flaw, including UNC5342 from DPRK deploying EtherRAT via the EtherHiding technique and a cluster tracked as CL-STA-1015 suspected to be tied to the PRC’s Ministry of State Security, using fileless execution to install SNOWLIGHT and VShell trojans.

Organisations are urged to upgrade: React to 19.0.1, 19.1.2, or 19.2.1 and Next.js to the latest patched versions such as 16.0.7 or 15.5.7. According to Unit 42 researchers at Palo Alto Networks.