React2Shell Exploits Flood the Internet as Attacks Continue

A torrent of PoC exploits for React2Shell followed the vulnerability’s disclosure, with Trend Micro researchers identifying about 145 public exploits, though most did not trigger the flaw. CVE-2025-55182 was disclosed on 3 December 2025, carrying a maximum CVSS score of 10 and exposing a remote code execution flaw rooted in unsafe deserialization in the React Server Components protocol that affects React open source software and frameworks such as Next.js.

Attacks against the vulnerability rose this week as opportunistic threat actors deployed cryptominers, infostealers and backdoors, with some exploits already containing backdoors or other malware. Some PoCs feature bypasses for web application firewalls, and researchers note that WAF rules alone may not be enough to stop exploitation, given various bypass techniques observed.

The report highlights a PoC that loads Godzilla, an in-memory web shell previously used in notable campaigns, and notes a Unicode-based bypass for WAFs as well as a separate tool intended to defend against the vulnerability. Vercel, which maintains Next.js, has launched a bug bounty programme on HackerOne paying $25,000 for high-severity bypasses and $50,000 for critical ones.