React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged federal agencies to patch the React2Shell vulnerability, CVE-2025-55182, by 12 December 2025 as exploitation spreads. The flaw, with a CVSS score of 10.0, affects the React Server Components Flight protocol and stems from unsafe deserialization that lets an attacker inject privileged JavaScript on a server; it also affects Next.js, Waku, Vite, React Router and RedwoodSDK.

Since its public disclosure on 3 December 2025, the vulnerability has been exploited by multiple threat actors in various campaigns to perform reconnaissance and deliver a range of malware families. Wiz described a rapid wave of opportunistic exploitation, targeting internet-facing Next.js applications and containerized workloads in Kubernetes and managed cloud services.

Cloudflare reported extensive internet-wide scanning and asset discovery activity, with some reconnaissance work excluding Chinese IP spaces and notable probing in Taiwan, Xinjiang, Vietnam, Japan and New Zealand. In honeypot data, Kaspersky recorded more than 35,000 exploitation attempts on 10 December 2025, while Shadowserver Foundation data showed over 137,200 internet-exposed IP addresses running vulnerable code, with about 88,900 in the United States.