React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js ยท updates https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate. en Fri, 12 Dec 2025 00:00:00 GMT React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js: Unit 42 updates its threat brief on ongoing exploitation https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182#2025-12-12-149dc090 Fri, 12 Dec 2025 00:00:00 GMT critical <p><a href="https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/">Source</a></p> React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js: CISA adds CVE-2025-55182 to KEV https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182#2025-12-05-57549a91 Fri, 05 Dec 2025 00:00:00 GMT critical <p>React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js: CISA adds CVE-2025-55182 to KEV</p> React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js: React discloses a critical vulnerability in React Server Components and ships fixes https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182#2025-12-03-f5502a7e Wed, 03 Dec 2025 00:00:00 GMT critical <p><a href="https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components">Source</a></p> React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js: AWS sees China-nexus groups exploiting it within hours https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182#2025-12-03-7a67c5d2 Wed, 03 Dec 2025 00:00:00 GMT critical <p>Including Earth Lamia and Jackpot Panda.</p> <p><a href="https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/">Source</a></p>