CVE-2025-55182: React Server Components Pre-Auth Deserialization RCE (KEV, "React2Shell")

CVE-2025-55182 (dubbed "React2Shell") is an unauthenticated remote code execution vulnerability in React Server Components: a remote attacker can send a specially crafted HTTP request to a Server Function endpoint that React unsafely deserializes, running arbitrary code on the server, and within hours of public disclosure multiple China-nexus threat clusters were observed actively exploiting it against internet-facing Next.js and other RSC-based applications.

CVE-2025-55182 is a deserialization-of-untrusted-data vulnerability (CWE-502) affecting React Server Components. NVD's description states: "A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints" (NVD).

The only CVSS data on record is a Secondary score submitted by Meta's CNA: CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. As of this writing NVD has not published its own independent Primary metric for this CVE, so this page reports the figure honestly as not NVD-confirmed rather than attributing it to NVD (NVD).

The React team's own advisory explains that any framework built on these packages is affected — including Next.js, React Router, Waku, Parcel RSC, the Vite RSC plugin and Redwood SDK — and that applications are vulnerable even if they don't explicitly use Server Functions. The fix shipped as react-server-dom-webpack/turbopack/parcel 19.0.1, 19.1.2 and 19.2.1, with framework-level guidance to upgrade Next.js to 14.2.35, 15.1.12 or 16.0.11 or later depending on the major line in use; hosting providers applied temporary edge mitigations, but the advisory stresses that upgrading remains required (React blog).

CISA added CVE-2025-55182 to the Known Exploited Vulnerabilities catalog with a known ransomware-campaign-use flag, and required agencies apply mitigations per vendor instructions or discontinue use of the product (CISA KEV).

AWS's threat intelligence team documented that within hours of the December 3, 2025 public disclosure, multiple China-nexus clusters — including the group AWS tracks as Earth Lamia alongside a cluster dubbed Jackpot Panda — were running both automated scanning (with user-agent randomization for evasion) and manual exploitation attempts against financial services, logistics, retail and government targets across Latin America, the Middle East and Southeast Asia, using reconnaissance commands like whoami and id before attempting file read/write (AWS Security Blog).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.9980 (99.957th percentile), among the highest EPSS scores tracked, consistent with the documented rapid, widespread in-the-wild exploitation (FIRST EPSS).

Any deployment running an affected react-server-dom-* package — directly or bundled inside a framework such as Next.js, React Router, Waku or Redwood SDK — should upgrade immediately to the patched release for its branch and review logs for the reconnaissance and payload-probing patterns documented by AWS.

• Pre-authentication RCE in React Server Components (react-server-dom-webpack/-turbopack/-parcel) versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0 via unsafe deserialization of HTTP payloads sent to Server Function endpoints. — NVD
• Only CVSS data on record is a Meta-submitted Secondary score, CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; no NVD Primary metric published as of this writing. — NVD
• Frameworks built on the affected packages (Next.js, React Router, Waku, Parcel RSC, Vite RSC plugin, Redwood SDK) are affected; fixed in react-server-dom-* 19.0.1/19.1.2/19.2.1 and corresponding Next.js releases (14.2.35, 15.1.12, 16.0.11 or later). — React blog
• Added to the CISA Known Exploited Vulnerabilities catalog with a known-ransomware-campaign-use flag. — CISA KEV
• Within hours of the December 3, 2025 disclosure, China-nexus clusters including Earth Lamia and Jackpot Panda ran automated and manual exploitation against financial services, logistics, retail and government targets across Latin America, the Middle East and Southeast Asia. — AWS Security Blog
• EPSS score is 0.9980 (99.957th percentile) as of 2026-10-29. — FIRST EPSS