In December 2025, a critical deserialization flaw in React Server Components (RSC) was disclosed as CVE-2025-55182, nicknamed "React2Shell." The vulnerability allows unauthenticated attackers to inject malicious Flight protocol payloads into server action requests, leading to remote code execution on Node.js and edge-runtime deployments. While the initial advisory focused on patching, defenders face a harder problem: identifying exploitation attempts in noisy HTTP logs and RSC-specific request bodies. This article provides a technical detection playbook—complete with Sigma, Suricata, and application-log rules—so your SOC can hunt for React2Shell activity before it becomes a breach.
Background: What Is CVE-2025-55182?
CVE-2025-55182 is a deserialization vulnerability in React Server Components, specifically in the Flight protocol used for client-server communication. The flaw arises when the server processes untrusted Flight payloads without proper validation, allowing an attacker to craft a request that triggers arbitrary object instantiation and, ultimately, remote code execution. According to the React security advisory, the vulnerability affects React 19.x before 19.2.0 and Next.js 15.x before 15.1.0 when using the App Router with server actions. The advisory assigns a CVSS v3.1 score of 9.8 (Critical) due to the unauthenticated, network-accessible attack vector.
React2Shell is particularly dangerous because it requires no authentication and can be triggered via a single HTTP POST to a server action endpoint. Public proof-of-concept exploits began circulating within days of disclosure, and CISA added CVE-2025-55182 to its Known Exploited Vulnerabilities catalog in December 2025, confirming active exploitation in the wild.
Affected Versions and Vendor Advisory
The vulnerability impacts any application using React Server Components with the Flight protocol. The GitHub advisory GHSA-2025-55182 lists the following affected versions:
- React 19.0.0 through 19.1.x
- Next.js 15.0.0 through 15.0.x (App Router with server actions)
- Any framework bundling React 19 RSC without the patch
Patched versions are React 19.2.0 and Next.js 15.1.0 or later. The advisory notes that applications using only client-side rendering or the Pages Router are not affected. However, many modern Next.js deployments default to the App Router, making the exposed surface larger than initial estimates suggested.
Attacker TTPs and MITRE ATT&CK Mapping
Exploitation of CVE-2025-55182 follows a consistent pattern that maps to several MITRE ATT&CK techniques:
- T1190 – Exploit Public-Facing Application: Attackers send crafted POST requests to server action endpoints (e.g.,
/api/actionor any route usinguse server). - T1059.004 – Command and Scripting Interpreter: Unix Shell: Successful exploitation often spawns a shell to execute commands like
curlorwgetto download second-stage payloads. - T1105 – Ingress Tool Transfer: Post-exploitation, attackers fetch additional tooling from attacker-controlled infrastructure.
- T1071.001 – Application Layer Protocol: Web Protocols: The entire attack occurs over HTTP/HTTPS, blending with legitimate traffic.
Public reports indicate that initial access is typically followed by reconnaissance commands (id, whoami, uname -a) and attempts to read environment variables for secrets. The CISA KEV entry confirms exploitation in the wild, and NVD provides the authoritative CVSS vector.
Detection: Sigma, Suricata, and Application Logs
Sigma Rule for RSC Exploitation Attempts
The following Sigma rule detects suspicious Flight protocol payloads in HTTP request bodies. It targets the characteristic "$$typeof" and "_payload" keys used in RSC serialization, which are rarely present in benign traffic to server action endpoints.
title: React Server Components Deserialization Attempt (CVE-2025-55182)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to RSC endpoints containing suspicious Flight payload keys.
references:
- https://github.com/facebook/react/security/advisories/GHSA-2025-55182
author: CybernytronX
date: 2025/12/10
logsource:
category: webserver
detection:
selection_method:
cs-method: 'POST'
selection_uri:
cs-uri-stem|contains:
- '/api/'
- '/_next/'
selection_body:
cs-body|contains:
- '$$typeof'
- '_payload'
- 'constructor'
condition: selection_method and selection_uri and selection_body
falsepositives:
- Legitimate RSC traffic with serialized props
level: highNote: This rule assumes your web server logs include request bodies (e.g., via ModSecurity or custom middleware). For body-less logs, rely on the Suricata rule below.
Suricata Rule for Network Detection
Suricata can inspect HTTP POST bodies for the same indicators. The rule below triggers on the $$typeof string in the body of a POST to common RSC paths.
alert http any any -> any any (msg:"CVE-2025-55182 React2Shell RSC Deserialization Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/"; http.request_body; content:"$$typeof"; nocase; reference:cve,2025-55182; reference:url,github.com/facebook/react/security/advisories/GHSA-2025-55182; classtype:attempted-admin; sid:1000001; rev:1;)Deploy this rule on your perimeter IDS/IPS and tune for false positives from legitimate RSC frameworks by excluding known-good source IPs or adding a pcre condition for anomalous payload sizes.
Application Log Analysis
For Node.js applications, instrument your server action handlers to log the full request body when an error occurs during deserialization. A typical exploit attempt will produce a stack trace containing SyntaxError: Unexpected token or TypeError: Cannot read property 'constructor' of undefined. Correlate these errors with a spike in 500 responses from /api/ endpoints. Additionally, monitor for outbound connections from your Node.js process to unusual IPs—this indicates post-exploitation command-and-control.
Mitigation and Patching
The primary mitigation is to upgrade to React 19.2.0 or Next.js 15.1.0. The React advisory provides detailed upgrade instructions. If immediate patching is not possible, consider the following workarounds:
- Disable server actions by removing
use serverdirectives or settingserverActions: falsein Next.js config (if supported). - Deploy a WAF rule to block POST requests containing
$$typeofin the body to RSC endpoints. - Restrict access to server action endpoints via IP allowlisting or authentication middleware.
The CISA KEV catalog mandates federal agencies to patch by the due date; private organizations should treat this as emergency patching.
Why This Matters for Defenders
React2Shell highlights a broader trend: modern frontend frameworks introduce serialization surfaces that traditional WAFs and log parsers do not understand. The Flight protocol is opaque to most security tools, and its payloads can easily evade signature-based detection unless you specifically instrument for RSC. SOC teams must extend detection beyond HTTP status codes and URIs to inspect request bodies and application-level errors. Furthermore, the speed of exploitation—public PoCs within 72 hours—means that mean time to detect (MTTD) is now measured in hours, not days. Organizations running React 19 in production should assume attempted exploitation and hunt proactively using the rules above.
Sources
- React Security Advisory GHSA-2025-55182 — Official disclosure, affected versions, and patched releases.
- CISA Known Exploited Vulnerabilities Catalog — Confirms active exploitation of CVE-2025-55182.
- NVD Entry for CVE-2025-55182 — CVSS score, vector, and reference links.
Frequently Asked Questions
Is CVE-2025-55182 exploitable if my app uses the Pages Router?
No. The vulnerability only affects React Server Components with the Flight protocol, which is used by the App Router. Pages Router applications do not expose the vulnerable deserialization path.
What is the CVSS score for React2Shell?
According to NVD, CVE-2025-55182 has a CVSS v3.1 base score of 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Can a WAF block React2Shell attacks?
A properly configured WAF can block known exploit patterns by inspecting POST bodies for $$typeof and other Flight-specific keys, but determined attackers may obfuscate payloads. Patching remains the definitive fix.
What should I look for in server logs to detect exploitation?
Look for POST requests to /api/ or /_next/ endpoints with unusually large bodies, followed by 500 errors containing deserialization stack traces, and outbound connections from the Node.js process to unfamiliar IPs.
Has React2Shell been used in ransomware attacks?
As of December 2025, public reporting links CVE-2025-55182 to initial access brokers and cryptocurrency mining, but not yet to ransomware deployment. However, the CISA KEV listing indicates active exploitation, and ransomware groups frequently adopt public exploits.
Need expert help with this?
If you're running React 19 in production and need to validate your exposure to CVE-2025-55182, CybernytronX offers targeted penetration testing and SOC detection engineering. Our Ethereon AI platform can help you baseline RSC traffic and flag anomalous Flight payloads in real time. Visit our contact page to discuss a rapid assessment, or learn more about Ethereon AI threat detection.