Historical intelligence backfill. This assessment covers reporting originally published on 2025-12-15 and was added to the RWP archive on 2026-09-07.
React2Shell was a CVSS 10 that China-nexus actors and ransomware both used before most shops patched
CVE-2025-55182 in React Server Components is unauthenticated RCE via the Flight protocol; CISA KEV, AWS China-nexus reporting, and at least one ransomware case followed disclosure by days.
Bottom line up front
CONFIRMED CVE-2025-55182 (React2Shell; CVE-2025-66478 later merged/rejected into it) is unsafe deserialization in React Server Components' Flight protocol. CVSS 10.0, unauthenticated RCE with a single crafted HTTP request. React disclosed 3 December 2025. CISA added KEV 5 December (FINRA cites 4 December). AWS reported China-nexus groups including Earth Lamia and Jackpot Panda exploiting within hours of disclosure. Microsoft's 15 December defender blog is the registry seed; it also saw opportunistic miners and backdoors. S-RM later documented Weaxor ransomware on an unpatched RSC server. Default Next.js App Router apps are in scope even if developers never wrote a custom server function.
Historical backfill of 15 December 2025 Microsoft guidance; disclosure 3 December; added 7 September 2026.
What happened
Lachlan Davidson reported the bug to Meta on 29 November 2025. React/Next shipped fixes 3 December. A public PoC followed 4 December. Mass scanning and China-nexus exploitation were already in motion. CISA KEV notes ransomware use. Microsoft's 15 December post is a hunting and patch article, not the first public notice — it is the enterprise-response brief this registry asked for.
Vulnerable lines (vendor/JFrog): react-server-dom-webpack/parcel/turbopack 19.0.0, 19.1.0–19.1.1, 19.2.0; Next.js 15.x and 16.x App Router and late 14.3 canaries. Patched React 19.0.1 / 19.1.2 / 19.2.1; Next 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 (and later). React later warned some intermediate patch builds were still unsafe — verify you are on the current fixed line, not the first hotfix you grabbed on 3 December.
Why it mattered
This is Log4Shell-shaped for the JavaScript server: default framework behavior, internet-facing, no auth, RCE. Headless storefronts, SaaS front-ends, and internal tools all sat on Next. WAF rules help; they are not a patch. Node child processes after a POST to an RSC endpoint are the hunting tell Microsoft emphasized.
Who / what was affected
Any internet-facing React 19 RSC or Next App Router on the vulnerable builds. Cloud-hosted Next is not "someone else's problem" — AWS said AWS services were not the bug, customer apps were. Ransomware: REPORTED by S-RM (Weaxor, limited to the vulnerable server in their case). China-nexus: REPORTED by AWS with named clusters. OT: not claimed.
Technical context
Flight deserializes attacker-controlled component trees. A malicious POST with chunk references / thenables executes in the Node process. RWP is not republishing PoC structure.
ATT&CK: T1190, then whatever the operator drops (T1496 mining, T1059, ransomware T1486).
Exploitation / threat status at the time
| Claim | Status |
|---|---|
| Unauth RCE in RSC | CONFIRMED |
| KEV | CONFIRMED |
| Exploitation within hours of disclosure | CONFIRMED (AWS) |
| Ransomware use | REPORTED (S-RM; CISA KEV "known" for ransomware) |
| First React patches complete | REPORTED incomplete; later rebuilds required |
What defenders should have done
- Inventory every Next/RSC internet app, including marketing sites and forgotten previews.
- Patch to the later fixed versions; do not trust 3 December nightlies.
- Hunt Node spawning shells, curl, miners from 3 December onward; rotate secrets on those hosts.
- WAF on Flight/RSC endpoints as containment, then still patch.
- Treat KEV due dates as the latest, not the target.
What we know now
Exploitation did not remain a researcher toy. Miners, backdoors, China-nexus, and at least one ransomware case. If the host is still on 19.0.0 in 2026, it is a standing incident.
RWP assessment
Confidence: High. This was the highest-urgency web RCE in the backfill window after Magento StyleSmuggler.
Defensive actions
- Lockfile/CI gate: ban vulnerable RSC packages.
- External scan for Next fingerprints; patch or take down.
- IR any host that was live 3–15 December 2025 unpatched.
- Do not copy PoCs into internal wikis; link the vendor advisory.
Sources
- Microsoft Threat Intelligence — Defending against CVE-2025-55182 React2Shell
- CISA — Known Exploited Vulnerabilities Catalog CVE-2025-55182
- AWS Security — China-nexus groups rapidly exploit React2Shell
- JFrog — CVE-2025-55182 and CVE-2025-66478 React2Shell
- S-RM — React2Shell used as initial access for Weaxor ransomware