# React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js · pwn.watch

> A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.

Page: https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 · generated 2026-10-22T23:13:41.393Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: React Server Components (react-server-dom-*), Next.js
- Started: 2025-12-03 · closed: 2025-12-12
- CVEs: CVE-2025-55182
- Affected: React 19.0.0, 19.1.0-19.1.1, 19.2.0 (react-server-dom-webpack / -parcel / -turbopack); Next.js App Router releases using affected React (see advisory)
- Fixed in: React 19.0.1; React 19.1.2; React 19.2.1; Next.js: patched release lines per the React/Next.js advisory

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182/feed.xml
- JSON Feed: https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182.json
- This file: https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182/llms.txt

## Updates (newest first)
- 2025-12-12: Unit 42 updates its threat brief on ongoing exploitation (https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/)
- 2025-12-05: CISA adds CVE-2025-55182 to KEV
- 2025-12-03: React discloses a critical vulnerability in React Server Components and ships fixes (https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components)
- 2025-12-03: AWS sees China-nexus groups exploiting it within hours (https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/)

## Fix brief
# Security brief: React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js

Source: https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 · status: closed (closed Dec 12, 2025) · severity: critical · updated Dec 12, 2025

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.

Severity detail: CVSS 10.0; exploited within hours (CISA KEV, known ransomware use)

- Product: React Server Components (react-server-dom-*), Next.js
- CVE / advisory ids: CVE-2025-55182

## Affected versions
- React 19.0.0, 19.1.0-19.1.1, 19.2.0 (react-server-dom-webpack / -parcel / -turbopack)
- Next.js App Router releases using affected React (see advisory)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- React 19.0.1
- React 19.1.2
- React 19.2.1
- Next.js: patched release lines per the React/Next.js advisory

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Dec 12, 2025: Unit 42 updates its threat brief on ongoing exploitation
- Dec 5, 2025: CISA adds CVE-2025-55182 to KEV
- Dec 3, 2025: React discloses a critical vulnerability in React Server Components and ships fixes
- Dec 3, 2025: AWS sees China-nexus groups exploiting it within hours

## Advisories
- [Critical Security Vulnerability in React Server Components](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) (React)
- [NVD: CVE-2025-55182](https://nvd.nist.gov/vuln/detail/CVE-2025-55182) (NVD)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)

## Write-ups & news
- [China-nexus cyber threat groups rapidly exploit React2Shell](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/)
- [Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)](https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182)
- [Exploitation of Critical Vulnerability in React Server Components](https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/)

## Caveats
Fixed React versions are from the React advisory. The exact Next.js patch versions per release line are listed in the advisory; verify there. The CVE also appears on the 2026 LexisNexis breach claim entry.

---
Machine-readable: https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.