In November 2025, a critical remote code execution flaw in React Server Components (RSC), tracked as CVE-2025-55182 and dubbed React2Shell, was disclosed and quickly observed in exploitation attempts against Next.js applications. The vulnerability allows unauthenticated attackers to execute arbitrary code on the server by sending crafted payloads to RSC endpoints. This article provides a deep technical analysis of the flaw, affected versions, attacker tactics, detection engineering with Sigma and Suricata rules, and actionable mitigation steps for security teams.
Background: What is CVE-2025-55182?
CVE-2025-55182 is a critical remote code execution vulnerability in React Server Components (RSC), a core part of modern React frameworks such as Next.js. The flaw arises from improper validation of user-supplied input during the deserialization of RSC payloads. An unauthenticated attacker can send a specially crafted HTTP request to an RSC endpoint (e.g., /_next/data or the root path with specific headers) to trigger server-side code execution. The vulnerability was assigned a CVSS v3.1 base score of 9.8 (Critical) by the vendor. According to the React security advisory, the issue affects React 19.x and Next.js versions that bundle the vulnerable RSC implementation.
The name React2Shell reflects the direct path from a React request to a shell on the server. Exploitation in the wild was first reported by multiple threat intelligence sources in late November 2025, with attackers leveraging the flaw to deploy web shells and cryptocurrency miners. The CISA KEV catalog added CVE-2025-55182 on December 2, 2025, confirming active exploitation.
Affected Versions and Vendor Advisory
The vulnerability impacts React Server Components as implemented in React 19.0.0 through 19.1.0, and Next.js versions 15.0.0 through 15.1.3, as well as 14.2.0 through 14.2.15 when the experimental RSC feature is enabled. The official advisory from the React team provides a detailed version matrix. Next.js users should consult the Vercel security advisory for patch guidance. Patched versions include React 19.1.1 and Next.js 15.1.4, 14.2.16. Organizations running unsupported or end-of-life versions are urged to upgrade immediately.
To check if your application is vulnerable, inspect your package.json for the React and Next.js versions. You can also run npm list react next in your project directory. If you are using a framework that depends on React, check for updates from that framework's maintainers.
Attacker TTPs and Exploitation Chain
Public reports indicate that attackers are exploiting CVE-2025-55182 by sending POST requests to RSC endpoints with a crafted JSON payload that abuses the deserialization process. The exploitation typically follows these steps:
- Reconnaissance (T1595): Attackers scan for Next.js applications by fingerprinting response headers such as
x-powered-by: Next.jsand known RSC endpoint paths. - Initial Access (T1190): A malicious request is sent to the RSC endpoint, triggering remote code execution. The payload often includes a command to download and execute a second-stage script.
- Execution (T1059.004): The attacker executes shell commands, typically using
curlorwgetto fetch a payload from a remote server. - Persistence (T1505.003): A web shell is dropped in a publicly accessible directory, allowing continued access.
- Impact (T1496): In observed campaigns, attackers deployed cryptocurrency miners, consuming server resources.
According to a BleepingComputer report, exploitation attempts began within 24 hours of the public disclosure, highlighting the speed at which threat actors weaponize critical vulnerabilities.
Detection: Sigma and Suricata Rules
Detecting exploitation attempts requires monitoring both network traffic and host-level indicators. Below are practical detection rules.
Sigma Rule for Suspicious RSC Requests
This Sigma rule detects HTTP POST requests to RSC endpoints with suspicious payload patterns. It is designed for web server logs (e.g., Apache, Nginx).
title: Suspicious RSC POST Request with Command Execution Patterns
description: Detects potential exploitation of CVE-2025-55182 via RSC endpoints
status: experimental
author: CybernytronX
logsource:
category: webserver
detection:
selection:
cs-method: 'POST'
cs-uri-stem|contains:
- '/_next/data'
- '/?__rsc='
cs-uri-query|contains:
- 'cmd='
- 'exec='
- 'curl '
- 'wget '
condition: selection
falsepositives:
- Legitimate RSC requests with unusual parameters
level: high
Suricata Rule for Network Detection
This Suricata rule inspects HTTP traffic for known exploitation patterns.
alert http any any -> any any (msg:"CVE-2025-55182 React2Shell Exploitation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/_next/data"; http_uri; content:"__rsc"; http_uri; content:"cmd="; http_client_body; nocase; reference:cve,2025-55182; reference:url,github.com/facebook/react/security/advisories; classtype:attempted-admin; sid:1000001; rev:1;)
For host-based detection, monitor for unexpected child processes of Node.js, such as sh, bash, or curl, using EDR or auditd. Also, watch for file creation in web-accessible directories with names like shell.php or exploit.js.
Mitigation and Patching
The primary mitigation is to upgrade to patched versions: React 19.1.1 or later, and Next.js 15.1.4, 14.2.16, or later. If immediate upgrading is not possible, consider the following temporary mitigations:
- Disable React Server Components if not required. In Next.js, this can be done by setting
experimental: { serverComponents: false }innext.config.js. - Implement a Web Application Firewall (WAF) rule to block requests containing suspicious patterns in RSC endpoints. However, WAF bypasses are possible, so patching is strongly recommended.
- Restrict network access to RSC endpoints to trusted IPs if feasible.
- Monitor for indicators of compromise (IOCs) such as outbound connections to known malicious IPs or unexpected processes.
Always refer to the official React advisory for the most up-to-date guidance.
Why This Matters for Defenders
CVE-2025-55182 underscores the risk of deserialization flaws in modern web frameworks. The speed of exploitation—within hours of disclosure—demonstrates that attackers are actively monitoring for new vulnerabilities. Defenders must prioritize patch management and implement layered detection. Given the widespread adoption of React and Next.js in enterprise applications, the blast radius is significant. Organizations should inventory their React-based applications, verify versions, and apply patches urgently. Additionally, security teams should enhance monitoring for RSC endpoints and train SOC analysts to recognize exploitation patterns. As frameworks evolve, similar flaws may emerge, making it essential to adopt secure coding practices and runtime protection.
Sources
- NVD entry for CVE-2025-55182 — confirms CVSS score and affected versions.
- CISA Known Exploited Vulnerabilities Catalog — lists CVE-2025-55182 as actively exploited.
- React Security Advisory — official patch and version information.
- Next.js Security Advisory — guidance for Next.js users.
- BleepingComputer report on React2Shell exploitation — details on in-the-wild attacks.
Frequently Asked Questions
What is CVE-2025-55182?
CVE-2025-55182 is a critical remote code execution vulnerability in React Server Components, allowing unauthenticated attackers to execute arbitrary code on the server via crafted RSC payloads.
Which versions are affected?
React 19.0.0 through 19.1.0 and Next.js 15.0.0-15.1.3 and 14.2.0-14.2.15 (with RSC enabled) are affected. Patched versions are React 19.1.1 and Next.js 15.1.4, 14.2.16.
Is there a public exploit?
Yes, exploitation has been observed in the wild, and proof-of-concept code is likely circulating. CISA added it to the KEV catalog on December 2, 2025.
How can I detect exploitation attempts?
Monitor web server logs for POST requests to RSC endpoints with suspicious parameters like cmd= or exec=. Use the provided Sigma and Suricata rules.
What is the recommended mitigation?
Immediately upgrade to patched versions. If not possible, disable RSC or implement WAF rules, but patching is the only complete fix.
Are there any IOCs available?
Public reports mention web shells and cryptocurrency miners. Check for unexpected files in web directories and outbound connections to unknown IPs.
Need expert help with this?
If your organization runs React or Next.js applications, CybernytronX can help you assess exposure, validate patches, and build detection for CVE-2025-55182. Our penetration testing and SOC build-out services, powered by Ethereon AI threat detection, ensure your defenses are ready for fast-moving threats. Contact us at cybernytronx.com/contact.html or learn more about Ethereon at cybernytronx.com/ethereon.html.