ClosedCriticalPatched

React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js

React Server Components (react-server-dom-*), Next.js

A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.

Why this severity: CVSS 10.0; exploited within hours (CISA KEV, known ransomware use)

Started: Dec 3, 2025
Closed: Dec 12, 2025
CVE: CVE-2025-55182

Follow this incident

Updated Dec 12, 2025

Affected

React 19.0.0, 19.1.0-19.1.1, 19.2.0 (react-server-dom-webpack / -parcel / -turbopack)
Next.js App Router releases using affected React (see advisory)

Fixed in

React 19.0.1
React 19.1.2
React 19.2.1
Next.js: patched release lines per the React/Next.js advisory

Timeline4

Dec 12, 2025
Unit 42 updates its threat brief on ongoing exploitation
Source
Dec 5, 2025
CISA adds CVE-2025-55182 to KEV
Dec 3, 2025
React discloses a critical vulnerability in React Server Components and ships fixes
Source
Dec 3, 2025
AWS sees China-nexus groups exploiting it within hours
Including Earth Lamia and Jackpot Panda.
Source

Advisories3

News & write-ups3

Notes & caveats

Fixed React versions are from the React advisory. The exact Next.js patch versions per release line are listed in the advisory; verify there. The CVE also appears on the 2026 LexisNexis breach claim entry.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified