https://pwn.watch/t/react2shell Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 12 Dec 2025 00:00:00 GMT https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182 Fri, 12 Dec 2025 00:00:00 GMT critical <p>A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> React 19.0.1, React 19.1.2, React 19.2.1, Next.js: patched release lines per the React/Next.js advisory</p> <p><strong>Latest updates:</strong></p><ul><li>2025-12-12: Unit 42 updates its threat brief on ongoing exploitation (<a href="https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/">source</a>)</li><li>2025-12-05: CISA adds CVE-2025-55182 to KEV</li><li>2025-12-03: React discloses a critical vulnerability in React Server Components and ships fixes (<a href="https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2025-55182</p>