{"slug":"react2shell","title":"React2Shell (CVE-2025-55182)","shortName":"React2Shell","summary":"Unauthenticated remote code execution in React Server Components via unsafe deserialization of the RSC Flight protocol. CVSS 10.0. Exploited in the wild within hours of disclosure. Listed in CISA KEV on 5 Dec 2025.","isExample":false,"draft":false,"family":"react2shell","kind":"framework","aliases":["CVE-2025-55182","CVE-2025-66478"],"publishedAt":"2025-12-03","updatedAt":"2026-10-24","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2025-55182","cvss":{"cve":"CVE-2025-55182","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-55182","sourceDate":"2026-10-18","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2025-55182","score":0.99802,"percentile":0.99958,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-55182","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2025-55182","listed":true,"dateAdded":"2025-12-05","dueDate":"2025-12-12","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated remote code execution in React Server Components (CVE-2025-55182), CVSS 10.0. Exploited within hours of disclosure and listed in CISA KEV.","action":"Patch RSC packages and Next.js App Router lines to the fixed releases, and rotate secrets for apps that were online unpatched."},"seenInTheWild":[{"metric":"possibly-vulnerable","value":77664,"observer":"Shadowserver","date":"2025-12-05","method":"Active check based on Assetnote methodology","sourceUrl":"https://infosec.exchange/@shadowserver/115672050969855947"},{"metric":"possibly-vulnerable","value":"over 165K IPs and 644K domains with vulnerable code","observer":"Shadowserver","date":"2025-12-08","method":"Improved scan targeting","sourceUrl":"https://infosec.exchange/@shadowserver/115690544827801847"},{"metric":"scanning","value":95,"observer":"GreyNoise","date":"2025-12-05","method":"Opportunistic scanning IPs, initial post (already cited on the page timeline)","sourceUrl":"https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far"},{"metric":"scanning","value":362,"observer":"GreyNoise","date":"2025-12-08","method":"Unique IPs attempting exploitation (152 with analysable payloads)","sourceUrl":"https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far"},{"metric":"scanning","value":8163,"observer":"GreyNoise","date":"2026-01-07","method":"Cumulative unique source IPs since disclosure across 1,071 ASNs; over 8.1 million attack sessions","sourceUrl":"https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far"},{"metric":"exposed","value":373894,"observer":"Shodan","date":"2026-10-23","method":"Product query http.component:\"Next.js\"","sourceUrl":"https://www.shodan.io/search?query=http.component%3A%22Next.js%22","note":"Exposed hosts. Data: Shodan."},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2025-12-05","method":"CISA Known Exploited Vulnerabilities catalog dateAdded","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"seenInTheWildLinks":[{"title":"Shadowserver dashboard","url":"https://dashboard.shadowserver.org/statistics/combined/tree/?date_range=1&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-55182%2B&data_set=count&scale=log","observer":"Shadowserver","metric":"possibly-vulnerable"},{"title":"NextRce Exploitation Tool (CVE-2025-55182)","url":"https://viz.greynoise.io/tags/nextrce-exploitation-tool-cve-2025-55182","observer":"GreyNoise","metric":"scanning"},{"title":"React Server Components Unsafe Deserialization CVE-2025-55182 RCE Attempt","url":"https://viz.greynoise.io/tags/react-server-components-unsafe-deserialization-cve-2025-55182-rce-attempt","observer":"GreyNoise","metric":"scanning"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"React2Shell is an unauthenticated remote code execution bug in React Server Components. Lachlan Davidson reported it to the React team on 29 Nov 2025. React published CVE-2025-55182 on 3 Dec 2025 and scored it CVSS 10.0.\n\nThe bug is unsafe deserialization in how React decodes payloads sent to React Server Function endpoints. An HTTP request to any Server Function endpoint can achieve code execution on the server. Apps that support React Server Components can be vulnerable even when they do not implement Server Function endpoints.\n\nAffected packages include react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack in React 19.0, 19.1.0, 19.1.1, and 19.2.0. Fixed in 19.0.1, 19.1.2, and 19.2.1. Frameworks that vendored or depended on those packages, including Next.js App Router 15.x and 16.x, were also affected. CVE-2025-66478 was later rejected as a duplicate of CVE-2025-55182.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"request","label":"Crafted request","detail":"An unauthenticated HTTP request reaches a React Server Function or RSC endpoint."},{"id":"deserialize","label":"Unsafe decode","detail":"React deserializes the Flight payload without enough validation."},{"id":"influence","label":"Server execution path","detail":"Attacker-controlled data influences server-side execution paths."},{"id":"exec","label":"Code exec","detail":"Remote code runs in the Node.js process that serves the app. Conceptual impact class only."}]},"exploitation":{"kev":{"listed":true,"date":"2025-12-05","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV entry for CVE-2025-55182, Meta React Server Components Remote Code Execution Vulnerability. dateAdded 2025-12-05."},"firstSeen":{"date":"2025-12-04","source":"AWS Security Blog / MadPot","note":"Amazon threat intelligence teams observed exploitation attempts by China-nexus groups, including Earth Lamia and Jackpot Panda, within hours of public disclosure on 3 Dec 2025."},"vendorStatements":[{"vendor":"React Team","date":"2025-12-03","statement":"There is an unauthenticated remote code execution vulnerability in React Server Components. We recommend upgrading immediately.","url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","retracted":false},{"vendor":"AWS","date":"2025-12-04","statement":"Within hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda.","url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","retracted":false},{"vendor":"Wiz Research","date":"2025-12-03","statement":"Exploitation has now been observed in the wild by Wiz Research, Amazon Threat Intelligence, Datadog and others. Wiz sensors identified multiple victims compromised starting December 5 at 6:00 AM UTC.","url":"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182","retracted":false}]},"timeline":[{"date":"2025-11-29","event":"Lachlan Davidson reports the vulnerability to the React team.","source":{"title":"Critical Security Vulnerability in React Server Components","url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","publisher":"React Team"},"kind":"disclosure","key":true},{"date":"2025-12-03","event":"React publishes CVE-2025-55182 and patched packages 19.0.1, 19.1.2, and 19.2.1.","source":{"title":"Critical Security Vulnerability in React Server Components","url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","publisher":"React Team"},"kind":"patch","key":true},{"date":"2025-12-03","event":"Next.js publishes CVE-2025-66478 for App Router impact and lists fixed 15.x and 16.x releases.","source":{"title":"Security Advisory: CVE-2025-66478","url":"https://nextjs.org/blog/CVE-2025-66478","publisher":"Next.js"},"kind":"advisory","key":true},{"id":"exploitation-attempts","date":"2025-12-04","event":"AWS MadPot records exploitation attempts from China-nexus infrastructure.","source":{"title":"China-nexus cyber threat groups rapidly exploit React2Shell","url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","publisher":"AWS"},"kind":"exploited","key":true},{"date":"2025-12-05","event":"CISA adds CVE-2025-55182 to the Known Exploited Vulnerabilities catalog.","source":{"title":"CISA KEV catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true},{"date":"2025-12-05","event":"Lachlan Davidson publishes original public PoCs on GitHub.","source":{"title":"React2Shell-CVE-2025-55182-original-poc","url":"https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc","publisher":"lachlan2k"},"kind":"poc","key":true},{"date":"2025-12-05","event":"Wiz Research reports compromised Next.js applications starting 6:00 UTC, with credential theft and cryptomining.","source":{"title":"React2Shell (CVE-2025-55182)","url":"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182","publisher":"Wiz Research"},"kind":"exploited","key":true},{"date":"2025-12-05","event":"GreyNoise reports opportunistic scanning from 95 IP addresses beginning 04:00 UTC.","source":{"title":"CVE-2025-55182 (React2Shell) Opportunistic Exploitation","url":"https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far","publisher":"GreyNoise"},"kind":"exploited"}],"defenderActions":[{"title":"Patch React Server Components packages","detail":"Upgrade react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack to 19.0.1, 19.1.2, or 19.2.1. Apps that do not use a server, or that do not use an RSC-capable framework or bundler, are not affected per the React advisory.","priority":"now","links":[{"label":"React advisory","href":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"}]},{"title":"Patch Next.js App Router lines","detail":"Upgrade Next.js 15.x and 16.x to the fixed release for your line (for example 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, or 16.0.7). Next.js states there is no workaround. The npx fix-react2shell-next helper can check and bump versions.","priority":"now","links":[{"label":"Next.js advisory","href":"https://nextjs.org/blog/CVE-2025-66478"}]},{"title":"Rotate secrets if exposed while unpatched","detail":"Next.js recommends rotating secrets for apps that were online and unpatched as of 4 Dec 2025, 13:00 PT, starting with the most critical ones.","priority":"now","links":[{"label":"Next.js advisory","href":"https://nextjs.org/blog/CVE-2025-66478"}]},{"title":"Review application and reverse-proxy logs","detail":"Look for POST requests with next-action or rsc-action-id headers, request bodies containing $@ or status resolved_model patterns, and unexpected process execution or file writes on app servers.","priority":"soon","links":[{"label":"AWS Security Blog","href":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/"}]},{"title":"Treat WAF rules as interim only","detail":"Hosting providers and WAFs published temporary mitigations. React and Next.js both say those are not a substitute for patching.","priority":"monitor"}],"detection":[{"title":"RSC action headers on POSTs","detail":"AWS lists POST requests with next-action or rsc-action-id headers, and request bodies containing $@ or status resolved_model patterns, as network indicators.","logSource":"Web access logs / reverse-proxy logs","kind":"generic","group":"web-proxy"},{"title":"Unexpected process or file activity on app hosts","detail":"AWS and Wiz describe post-exploitation that runs reconnaissance commands, writes files under /tmp, harvests cloud credentials, and drops miners or frameworks such as Sliver or XMRig.","logSource":"EDR / process telemetry","kind":"generic","group":"edr"},{"title":"Akamai App & API Protector: rule 3000976","detail":"Adaptive Security Engine Rapid Rule 3000976 'React RCE Attack Detected' released 2025-12-03 for CVE-2025-55182.","logSource":"Akamai Security Events (WAF) logs","kind":"vendor-signature","url":"https://www.akamai.com/blog/security-research/cve-2025-55182-react-nextjs-server-functions-deserialization-rce","date":"2025-12-03"},{"title":"AWS WAF managed rule set","detail":"AWSManagedRulesKnownBadInputsRuleSet version 1.24 or higher includes updated rules for CVE-2025-55182.","logSource":"AWS WAF event logs","kind":"vendor-signature","url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","date":"2025-12-04"},{"title":"Azure WAF: DRS 99001018 / CRS 800115","detail":"DRS rule 99001018 and CRS 3.x rule 800115 for CVE-2025-55182. Rule reference page has no per-rule date.","logSource":"Azure WAF diagnostic logs (ApplicationGatewayFirewallLog)","kind":"vendor-signature","url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules","date":"2026-10-23"},{"title":"NetScaler WAF signature: 998201","detail":"NetScaler WAF signature update version 166: rule 998201 (WEB-MISC React Server RCE) for CVE-2025-55182.","logSource":"NetScaler WAF (AppFw) logs","kind":"vendor-signature","url":"https://docs.netscaler.com/us/en/citrix-adc/current-release/signature-alerts/signature-update-version-166.html","date":"2026-10-23","dateKind":"checked"},{"title":"Cloudflare WAF Managed Rules: React - RCE (...5fb92fba, ...15fce168)","detail":"Emergency rule ...5fb92fba 'React - RCE - CVE-2025-55182' released 2025-12-03. Improved rule ...15fce168 added 2025-12-10.","logSource":"Cloudflare Security Events / Firewall events","kind":"vendor-signature","url":"https://developers.cloudflare.com/changelog/post/2025-12-03-emergency-waf-release/","date":"2025-12-03"},{"title":"F5 attack signatures: 200204048 / 200204050","detail":"React Server Components RCE (200204048) and Next.js RSC Remote Code Execution (200204050), referencing CVE-2025-55182 and CVE-2025-66478. F5 blog dated 2025-12-04; signature last update 2025-12-11.","logSource":"F5 Advanced WAF / Distributed Cloud WAF event logs","kind":"vendor-signature","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2025-12-11"},{"title":"Fastly Next-Gen WAF: virtual patch CVE-2025-55182 / CVE-2025-66478","detail":"Virtual patch added 2025-12-03. Enabled by default with immediate blocking from 2025-12-05.","logSource":"Fastly Next-Gen WAF signal logs","kind":"vendor-signature","url":"https://www.fastly.com/documentation/reference/changes/2025/12/added-virtual-patch-for-cve-2025-66478/","date":"2025-12-03"},{"title":"Fortinet FortiWeb: 1090502460 / 1090502462 / 1090502464","detail":"FortiWeb signatures CVE-2025-55182.React.CVE-2025-66478.Next.js (1090502460, 1090502462 on 2025-12-02; 1090502464 on 2025-12-06).","logSource":"FortiWeb attack logs","kind":"vendor-signature","url":"https://www.fortiguard.com/outbreak-alert/react2shell-rce","date":"2026-10-23","dateKind":"checked"},{"title":"Google Cloud Armor: google-mrs-v202512-id000001-rce / id000002-rce","detail":"cve-canary preconfigured rules google-mrs-v202512-id000001-rce (2025-12-03) and google-mrs-v202512-id000002-rce (2025-12-06) for CVE-2025-55182.","logSource":"Cloud Armor request logs (Cloud Logging)","kind":"vendor-signature","url":"https://docs.cloud.google.com/armor/docs/release-notes","date":"2025-12-03"},{"title":"Imperva Cloud WAF: React Server Components virtual patch","detail":"Imperva states virtual patching rules were rolled out to all Cloud WAF customers within hours. On-premises WAF needs the published mitigation policy. No rule IDs published.","logSource":"WAF event logs","kind":"vendor-signature","url":"https://www.imperva.com/blog/imperva-customers-protected-against-react-server-components-rsc-vulnerability/","date":"2025-12-04"},{"title":"OWASP CRS: rule 934100 (CRS v4.22.0)","detail":"CRS v4.22.0 release notes: 'feat(934100): added sequence for CVE-2025-55182 POCs'.","logSource":"ModSecurity / Coraza audit logs","kind":"vendor-signature","url":"https://github.com/coreruleset/coreruleset/releases/tag/v4.22.0","date":"2026-01-05"},{"title":"Radware SUS signatures for CVE-2025-55182 / CVE-2025-66478","detail":"Radware states its Security Update Service published signatures to block CVE-2025-55182 and CVE-2025-66478 exploit attempts. No rule ID published.","logSource":"Radware AppWall / Cloud WAF security events","kind":"vendor-signature","url":"https://www.radware.com/security/threat-advisories-and-attack-reports/react2shell-a-cvss-10-0-rce-vulnerability-in-react-server-components-cve-2025-55182/","date":"2025-12-05"},{"title":"Check Point IPS: CPAI-2025-7812 / CPAI-2025-7993 / CPAI-2025-8319","detail":"Protections 'React Server Components Remote Code Execution (CVE-2025-55182)', published 2025-12-04.","logSource":"Check Point IPS logs (SmartConsole / Logs & Monitor)","kind":"vendor-signature","url":"https://advisories.checkpoint.com/defense/advisories/public/2025/cpai-2025-7812.html","date":"2025-12-04"},{"title":"Cisco Talos Snort: 1:65554","detail":"SERVER-WEBAPP React Server Components remote code execution attempt, enabled by default, released 2025-12-04.","logSource":"Snort / Cisco Secure Firewall IPS event logs","kind":"vendor-signature","url":"https://www.snort.org/advisories/talos-rules-2025-12-04-12-4-2025","date":"2025-12-04"},{"title":"Fortinet FortiGuard IPS: 59644","detail":"IPS signature React.Server.Components.react-flight.Remote.Code.Execution (59644), 2025-12-05.","logSource":"FortiGate IPS logs","kind":"vendor-signature","url":"https://www.fortiguard.com/search?q=CVE-2025-55182&engine=1","date":"2025-12-02"},{"title":"Juniper IDP: HTTP:CTS:META-JS-INSEC-DSRLIZ","detail":"IDP signature for CVE-2025-55182, sigpack 3876, release date 2026-01-02, recommended action Drop.","logSource":"Juniper SRX IDP logs","kind":"vendor-signature","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:META-JS-INSEC-DSRLIZ.html","date":"2026-01-02"},{"title":"Palo Alto Networks Threat Prevention: 96779 / 96780 / 96787","detail":"Threat IDs 96779, 96780 and 96787 for CVE-2025-55182 / CVE-2025-66478 per Unit 42.","logSource":"Palo Alto Networks threat logs (Threat Prevention / NGFW)","kind":"vendor-signature","url":"https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/","date":"2025-12-12"},{"title":"Sophos Firewall IPS: React Server Components CVE-2025-55182 signatures","detail":"IPS release 18.24.24 (2025-12-09) lists 'React Server Components CVE-2025-55182 Pre-Authenticated Remote Code Execution'. 18.24.31 (2025-12-23) adds an insecure deserialization signature. No SIDs in the notes.","logSource":"Sophos Firewall IPS logs","kind":"vendor-signature","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.24.24.html","date":"2025-12-09"},{"title":"Trend Micro Deep Security 1012494 / 1012497, TippingPoint 46746","detail":"Deep Security IPS rules 1012494 and 1012497. TippingPoint filter 46746 'HTTP: React Server Components Code Execution Vulnerability (React2Shell)'.","logSource":"Trend Micro Deep Security / TippingPoint SMS event logs","kind":"vendor-signature","url":"https://success.trendmicro.com/en-US/solution/ka-0021831","date":"2025-12-05","dateKind":"checked"},{"title":"Cato IPS: CVE-2025-55182 signatures","detail":"Cato IPS virtual patch. Opt-in protection 2025-12-05, global protection 2025-12-06. No rule ID published.","logSource":"Cato Networks IPS events","kind":"vendor-signature","url":"https://www.catonetworks.com/rapid-cve-mitigation/","date":"2026-10-23","dateKind":"checked"},{"title":"Netskope IPS: 65554, 301039-301043, ET 2066027-2066029","detail":"Netskope Threat Labs IPS library lists SERVER-WEBAPP React Server Components RCE (65554, 301039-301043) and ET React2Shell SIDs 2066027-2066029 for CVE-2025-55182. Library pages are undated.","logSource":"Netskope Cloud Firewall / IPS alert logs","kind":"vendor-signature","url":"https://threatlabs.netskope.com/library/ips/server-webapp-react-server-components-remote-code-execution-attempt/","date":"2026-10-23","dateKind":"checked"},{"title":"Zscaler ZPA AppProtection: 6000412","detail":"ZPA AppProtection rule 6000412 'React Server Remote Code Execution (CVE-2025-55182)'.","logSource":"Zscaler ZPA AppProtection logs","kind":"vendor-signature","url":"https://www.zscaler.com/blogs/security-research/react2shell-remote-code-execution-vulnerability-cve-2025-55182","date":"2025-12-08"}],"detectionRules":[{"id":"sigma-react2shell-linux-node-child","title":"Linux Suspicious Child Process from Node.js - React2Shell","language":"sigma","query":"title: Linux Suspicious Child Process from Node.js - React2Shell\nid: c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7\nrelated:\n    - id: 271de298-cc0e-4842-acd8-079a0a99ea65\n      type: similar\nstatus: experimental\ndescription: |\n    Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell).\n    This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands.\n    When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>).\n    For other methods, the Image field will show the spawned process directly.\nreferences:\n    - https://github.com/msanft/CVE-2025-55182\n    - https://nodejs.org/api/child_process.html#class-childprocess\n    - https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870\n    - https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali\ndate: 2025-12-05\ntags:\n    - attack.execution\n    - attack.t1059\n    - attack.initial-access\n    - attack.t1190\n    - detection.emerging-threats\n    - cve.2025-55182\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_parent:\n        ParentImage|endswith: '/node'\n        ParentCommandLine|contains:\n            - '--experimental-https'\n            - '--experimental-next-config-strip-types'\n            - '/node_modules/next'\n            - 'next dev'\n            - 'next start'\n            - 'node_modules/.bin'\n            - 'react-scripts start'\n            - 'start-server.js'\n    selection_generic_child_img:\n        # Observed when child_process.spawn(), child_process.exec(), child_process.execFile(), or child_process.fork() method is used to spawn suspicious processes in exploit\n        - Image|endswith:\n              - '/busybox'\n              - '/cat'\n              - '/curl'\n              - '/dash'\n              - '/dig'\n              - '/head'\n              - '/id'\n              - '/ifconfig'\n              - '/ip'\n              - '/java'\n              - '/less'\n              - '/lua'\n              - '/more'\n              - '/nc'\n              - '/ncat'\n              - '/netcat'\n              - '/netstat'\n              - '/nslookup'\n              - '/perl'\n              - '/ping'\n              - '/python'\n              - '/python2'\n              - '/ruby'\n              - '/socat'\n              - '/tail'\n              - '/wget'\n              - '/whoami'\n        - Image|contains: '/python'\n    selection_generic_child_cli:\n        # Observed when child_process.execSync() is used to spawn suspicious processes\n        # Reference: https://nodejs.org/api/child_process.html#child_processexecsynccommand-options\n        # By default, the cli will look something like `/bin/sh -c .......`\n        CommandLine|contains:\n            - '/dev/tcp/'\n            - '/dev/udp/'\n            - '/etc/hosts'\n            - '/etc/passwd'\n            - '/etc/shadow'\n            - 'base64'\n            - 'cat '\n            - 'curl'\n            - 'dig'\n            - 'ifconfig'\n            - 'IO::Socket::INET'\n            - 'java'\n            - 'less '\n            - 'lua'\n            - 'mkfifo '\n            - 'more'\n            - 'nc '\n            - 'ncat'\n            - 'netcat'\n            - 'netstat'\n            - 'nslookup'\n            - 'perl'\n            - 'php'\n            - 'ping'\n            - 'ps -ef'\n            - 'ps aux'\n            - 'python'\n            - 'rcat'\n            - 'ruby'\n            - 'sh -i 2>&1'\n            - '-c id'\n            - 'socat'\n            - 'uname'\n            - 'wget'\n            - 'whoami'\n    selection_specific_sh:\n        Image|endswith: '/sh'\n    selection_specific_cli:\n        Image|endswith: '-c'\n    filter_main_default_shell_flag:\n        Image|endswith: '-c'\n    condition:\n        selection_parent and\n        (\n            1 of selection_generic_*\n            or\n            (selection_specific_sh and not filter_main_default_shell_flag)\n            or\n            (all of selection_specific_* and selection_generic_child_cli)\n        )\nfalsepositives:\n    - Unknown\nlevel: high","logSource":"Linux process creation (Sysmon for Linux 1 / auditd)","author":"Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali","authorUrl":"https://github.com/SigmaHQ/sigma","sourceUrl":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_lnx_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml","sourceDate":"2025-12-05","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"sigma-react2shell-windows-node-child","title":"Windows Suspicious Child Process from Node.js - React2Shell","language":"sigma","query":"title: Windows Suspicious Child Process from Node.js - React2Shell\nid: 271de298-cc0e-4842-acd8-079a0a99ea65\nrelated:\n    - id: c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7\n      type: similar\nstatus: experimental\ndescription: |\n    Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell).\n    Attackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync().\n    If execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked.\n    For other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.\nreferences:\n    - https://github.com/msanft/CVE-2025-55182\n    - https://nodejs.org/api/child_process.html#class-childprocess\n    - https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870\n    - https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali\ndate: 2025-12-05\ntags:\n    - attack.execution\n    - attack.t1059\n    - attack.initial-access\n    - attack.t1190\n    - detection.emerging-threats\n    - cve.2025-55182\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|endswith: '\\node.exe'\n        ParentCommandLine|contains:\n            - '--experimental-https'\n            - '--experimental-next-config-strip-types'\n            - '\\node_modules\\next'\n            - 'next dev'\n            - 'next start'\n            - 'next\" start'\n            - 'node_modules\\\\.bin\\\\\\\\..\\\\next' # We escape every backslash to avoid confusion\n            - 'react-scripts start'\n            - 'start-server.js'\n    selection_generic_child_img:\n        # Observed when child_process.spawn(), child_process.exec(), child_process.execFile(), or child_process.fork() method  is used to spawn suspicious processes\n        - Image|endswith:\n              - '\\bash.exe'\n              - '\\bitsadmin.exe'\n              - '\\certutil.exe'\n              - '\\cscript.exe'\n              - '\\curl.exe'\n              - '\\ipconfig.exe'\n              - '\\mshta.exe'\n              - '\\net.exe'\n              - '\\net1.exe'\n              - '\\netsh.exe'\n              - '\\nslookup.exe'\n              - '\\OpenConsole.exe'\n              - '\\perl.exe'\n              - '\\ping.exe'\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n              - '\\py.exe'\n              - '\\python.exe'\n              - '\\pythonw.exe'\n              - '\\pyw.exe'\n              - '\\reg.exe'\n              - '\\regsvr32.exe'\n              - '\\rundll32.exe'\n              - '\\sc.exe'\n              - '\\sh.exe'\n              - '\\systeminfo.exe'\n              - '\\wget.exe'\n              - '\\whoami.exe'\n              - '\\wmic.exe'\n              - '\\wscript.exe'\n              - '\\wt.exe'\n        - Image|contains: '\\python'\n    selection_generic_child_cli_susp_pattern:\n        # Observed when child_process.execSync() is used to spawn suspicious processes\n        # Reference: https://nodejs.org/api/child_process.html#child_processexecsynccommand-options\n        # In default, the cli will look something like `C:\\WINDOWS\\System32\\cmd.exe /d /s /c \"...susp..cli....\"`\n        CommandLine|contains:\n            - '\\net'\n            - 'bitsadmin'\n            - 'certutil '\n            - 'conhost --headless'\n            - 'cscript '\n            - 'curl'\n            - 'ipconfig'\n            - 'java'\n            - 'lua'\n            - 'mshta'\n            - 'netsh'\n            - 'nslookup '\n            - 'perl'\n            - 'ping '\n            - 'powershell'\n            - 'pwsh'\n            - 'python'\n            - 'reg '\n            - 'reg.exe'\n            - 'regsvr32'\n            - 'ruby'\n            - 'rundll32'\n            - 'sc.exe'\n            - 'systeminfo'\n            - 'wget'\n            - 'whoami'\n            - 'wmic'\n            - 'wscript'\n    selection_specific_cmd:\n        Image|endswith: '\\cmd.exe'\n    selection_specific_cli:\n        CommandLine|contains: '/d /s /c '\n    filter_main_default_shell_flag:\n        CommandLine|contains: '/d /s /c '\n    filter_main_cli_git:\n        CommandLine|contains: 'git config --local --get remote.origin.url'\n    filter_main_cli_netstat:\n        CommandLine|contains|all:\n            - 'netstat -ano | findstr /C:'\n            - ' | findstr LISTENING'\n    filter_main_cli_mkcert_install:\n        CommandLine|contains|all:\n            - '\\mkcert\\'\n            - ' -install '\n    filter_main_cli_mkcert_caroot:\n        CommandLine|contains|all:\n            - '\\mkcert\\'\n            - ' -CAROOT'\n    condition:\n        selection_parent and\n        (\n            1 of selection_generic_*\n            or\n            (selection_specific_cmd and not filter_main_default_shell_flag)\n            or\n            (all of selection_specific_* and not 1 of filter_main_cli_*)\n        )\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_win_exploit_cve_2025_55182_susp_nodejs_server_child_process/info.yml","logSource":"Windows process creation (Sysmon 1 / 4688)","author":"Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali","authorUrl":"https://github.com/SigmaHQ/sigma","sourceUrl":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_win_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml","sourceDate":"2025-12-05","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"splunk-linux-react-nextjs-child","title":"Linux Suspicious React or Next.js Child Process","language":"spl","query":"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime\n  from datamodel=Endpoint.Processes\n  where\n    Processes.parent_process_name = \"node\"\n    Processes.parent_process IN (\n      \"*--experimental-https*\",\n      \"*--experimental-next-config-strip-types*\",\n      \"*/node_modules/next*\",\n      \"*next dev*\",\n      \"*next start*\",\n      \"*node_modules/.bin*\",\n      \"*react-scripts start*\",\n      \"*start-server.js*\"\n    )\n    AND (\n      Processes.process_name IN (\n        \"awk\",\n        \"gawk\",\n        \"ifconfig\",\n        \"lua\",\n        \"nc\",\n        \"ncat\",\n        \"netcat\",\n        \"openssl\",\n        \"perl\",\n        \"php\",\n        \"python\",\n        \"python2\",\n        \"python3\",\n        \"ruby\",\n        \"socat\",\n        \"telnet\"\n      )\n      OR (\n        Processes.process_name IN (\"curl\", \"wget\")\n        Processes.process = \"*|*\"\n      )\n      OR (\n        Processes.process_name IN (\n          \"bash\",\n          \"dash\",\n          \"sh\"\n        )\n        NOT Processes.process = \"*-c*\"\n      )\n      OR (\n        Processes.process_name IN (\n          \"bash\",\n          \"dash\",\n          \"ksh\",\n          \"sh\",\n          \"zsh\"\n        )\n        Processes.process IN (\n          \"*/dev/tcp/*\",\n          \"*/dev/udp/*\",\n          \"*0>&1*\",\n          \"*curl*\",\n          \"*exec *>&*\",\n          \"*fsockopen*\",\n          \"*ifconfig*\",\n          \"*mkfifo*\",\n          \"*nc *\",\n          \"*ncat*\",\n          \"*netcat*\",\n          \"*proc_open*\",\n          \"*s_client*\",\n          \"*socat*\",\n          \"*socket*\",\n          \"*subprocess*\",\n          \"*TCPSocket*\",\n          \"*wget*\"\n        )\n      )\n    )\n\nby Processes.action Processes.dest Processes.original_file_name Processes.parent_process\n   Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id\n   Processes.parent_process_name Processes.parent_process_path Processes.process\n   Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id\n   Processes.process_integrity_level Processes.process_name Processes.process_path\n   Processes.user Processes.user_id Processes.vendor_product\n\n| `drop_dm_object_name(Processes)`\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `linux_suspicious_react_or_next_js_child_process_filter`","logSource":"Sysmon for Linux EventID 1 (Endpoint.Processes data model)","author":"Nasreddine Bencherchali, Splunk","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/linux_suspicious_react_or_next_js_child_process.yml","sourceDate":"2026-05-13","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/linux_suspicious_react_or_next_js_child_process.yml"},{"id":"elastic-react2shell-network-attempt","title":"React2Shell (CVE-2025-55182) Exploitation Attempt","language":"eql","query":"network where http.request.method == \"POST\" and\n(\n    // Successful CVE-2025-55182 RCE - command output in digest\n    (\n        http.response.status_code in (500, 303) and\n        http.response.body.content like~ \"*E{\\\"digest\\\"*\" and\n        http.request.body.content regex~ \"\"\".*\\$[0-9]+:[a-zA-Z_0-9]+:[a-zA-Z_0-9]+.*\"\"\"\n    ) or\n    // Prototype pollution attempts in RSC Flight data (never legitimate)\n    (\n        http.request.body.content regex~ \"\"\".*\\$[0-9]+:[a-zA-Z_0-9]+:[a-zA-Z_0-9]+.*\"\"\" and\n        (\n            http.request.body.content like~ \"*__proto__*\" or\n            http.request.body.content like~ \"*prototype*\"\n        )\n    )\n)","logSource":"Elastic Network Packet Capture (network_traffic.http) with request and response bodies","author":"Elastic","authorUrl":"https://github.com/elastic/detection-rules","sourceUrl":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/network/initial_access_react_server_components_rce_attempt.toml","sourceDate":"2026-09-18","license":"Elastic License 2.0","origin":"vendor","tested":"untested"},{"id":"ms-react2shell-next-server-linux-commands","title":"Suspicious commands initiated by the next-server parent process (Linux)","language":"kql","query":"let lookback = 10d;\nDeviceProcessEvents\n| where Timestamp >= ago(lookback)\n| where InitiatingProcessFileName == \"node\"\n| where InitiatingProcessCommandLine has_any (\" server.js\", \" start\", \"/server.js\")\n| where ProcessCommandLine  has_any (\"| sh\", \"openssl,\", \"/dev/tcp/\", \"| bash\", \"|sh\", \"|bash\", \"bash,\", \"{sh,}\", \"SOCK_STREAM\", \"bash -i\", \"whoami\", \"| base64 -d\", \"chmod +x /tmp\", \"chmod 777\")\n| where ProcessCommandLine !contains \"vscode\" and ProcessCommandLine !contains \"/.claude/\"  and ProcessCommandLine !contains \"/claude\"","logSource":"Microsoft Defender for Endpoint DeviceProcessEvents (Linux)","author":"Microsoft Defender Security Research Team","authorUrl":"https://www.microsoft.com/en-us/security/blog/","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","sourceDate":"2025-12-15","license":"Posted publicly; see source","origin":"vendor","notes":"Short hunting query copied from the blog's Defender XDR section; more queries there.","tested":"untested"},{"id":"v2s-logscale-node-shell-child","title":"Shell or downloader spawned by Node.js (Falcon)","language":"logscale","query":"#event_simpleName=ProcessRollup2 event_platform=Lin\n| ParentBaseFileName=node\n| FileName=/^(sh|bash|dash|curl|wget|nc|ncat|socat|python3?)$/i\n| groupBy([aid, ComputerName, FileName, CommandLine], limit=max)","logSource":"CrowdStrike Falcon ProcessRollup2 (Linux)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_lnx_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml","sourceDate":"2025-12-05","license":"CC0 1.0","origin":"vuln2shell","notes":"Falcon version of a subset of the child-process list in the SigmaHQ React2Shell rule. Falcon ProcessRollup2 has no parent command line, so it cannot narrow to Next.js servers; scope by host group.","tested":"untested"},{"id":"et-react2shell-flight-protocol","title":"ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)","language":"suricata","query":"alert http any any -> $HOME_NET any (msg:\"ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)\"; flow:established,to_server; http.header; to_lowercase; content:\"next-action|3a 20|\"; fast_pattern; http.content_type; content:\"multipart/form-data|3b|\"; http.request_body; content:\"|24 40|\"; pcre:\"/^[0-9a-fA-F]+\\x22?[\\x0d\\x0a]+/R\"; content:\"|22|_prefix|22|\"; content:\"|22|_formData|22|\"; content:\"|22 24|\"; pcre:\"/^[0-9a-fA-F]+\\x3a(?:__proto__|constructor|Module)\\x3a/R\"; http.method; content:\"POST\"; reference:url,react2shell.com/; reference:cve,2025-55182; classtype:web-application-attack; sid:2066027; rev:4; metadata:affected_product Next_js, affected_product React, attack_target Server, tls_state TLSDecrypt, created_at 2025_12_04, cve CVE_2025_55182, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Exploit, updated_at 2026_04_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-web_specific_apps.rules","sourceDate":"2026-04-30","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","notes":"Needs decrypted HTTP to see request bodies.","tested":"untested"},{"id":"yara-react2shell-nextjs-error-logs","title":"EXPL_RCE_React_Server_Next_JS_CVE_2025_66478_Errors_Dec25","language":"yara","query":"rule EXPL_RCE_React_Server_Next_JS_CVE_2025_66478_Errors_Dec25 {\n   meta:\n      description = \"Detects error messages caused by the exploitation of the React Server Remote Code Execution Vulnerability (CVE-2025-55182) in Next.js applications (CVE-2025-66478). This can also be caused by vulnerability scanning.\"\n      author = \"Florian Roth\"\n      reference = \"https://github.com/Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478\"\n      date = \"2025-12-05\"\n      score = 65\n      id = \"6baeb522-6299-56a2-be27-21c6b668439b\"\n   strings:\n      $s1 = \"[Error: NEXT_REDIRECT]\"\n      $s2 = \"digest: 'uid=0(root) gid=0(root)\"\n   condition:\n      all of them\n}","logSource":"Application and container log files (YARA or THOR scan)","author":"Florian Roth","authorUrl":"https://github.com/Neo23x0/signature-base","sourceUrl":"https://github.com/Neo23x0/signature-base/blob/3ce6640c26046da8e6d8094af3eaaee3ee84e648/yara/react_pocs_indicators_dec25.yar","sourceDate":"2025-12-05","license":"DRL-1.1","origin":"community","notes":"Flags error messages left in Next.js logs by exploitation. Scanners trigger it too.","tested":"untested"}],"detectionLinks":[{"title":"Microsoft: Defending against CVE-2025-55182 (React2Shell)","url":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","author":"Microsoft Defender Security Research Team","date":"2025-12-15","note":"More Defender XDR and Sentinel queries (encoded PowerShell, Windows next-server children, CloudAuditEvents)."},{"title":"Elastic: Suspicious React Server Child Process","url":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/initial_access_execution_susp_react_serv_child.toml","author":"Elastic","date":"2026-09-18","note":"EQL, Elastic License 2.0."},{"title":"Splunk: Windows Suspicious React or Next.js Child Process","url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml","author":"Splunk Threat Research Team"},{"title":"signature-base: React2Shell campaign YARA (ZinFoq, CowTunnel, PeerBlight)","url":"https://github.com/Neo23x0/signature-base/blob/3ce6640c26046da8e6d8094af3eaaee3ee84e648/yara/mal_react2shell_campaigns_dec25.yar","author":"RussianPanda","date":"2025-12-08"},{"title":"AWS: China-nexus groups rapidly exploit React2Shell","url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","author":"AWS Security","date":"2025-12-04"}],"retrohunt":{"summary":"Search reverse-proxy and app logs back to 4 Dec 2025 for POSTs with next-action or rsc-action-id headers, then hunt for node or next-server spawning shells and for files under /tmp.","lookback":{"from":"2025-12-04","basis":"first-attempt","rationale":"AWS MadPot saw exploitation attempts within hours of public disclosure on 3 Dec 2025, dated 4 Dec. Wiz reports compromised Next.js apps from 6:00 UTC on 5 Dec. GreyNoise saw opportunistic scanning from 04:00 UTC on 5 Dec.","sources":[{"url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","date":"2025-12-04","publisher":"AWS"},{"url":"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182","date":"2025-12-05","publisher":"Wiz"}]},"logSources":[{"name":"Reverse-proxy / CDN request logs","why":"Show next-action and rsc-action-id headers and unusual POST bodies.","required":true},{"name":"Application / Next.js server logs","why":"Show RSC errors and request patterns.","required":true},{"name":"EDR process telemetry for node / next-server","why":"Post-exploitation runs reconnaissance and drops miners or frameworks.","required":true},{"name":"File events under /tmp and app directories","why":"AWS and Wiz describe writes under /tmp and credential theft.","required":false}],"steps":[{"title":"Search for RSC action headers","detail":"AWS lists POST requests with next-action or rsc-action-id headers, and bodies containing $@ or status resolved_model patterns.","sources":[{"url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","date":"2025-12-04","publisher":"AWS"}]},{"title":"Hunt node / next-server child processes","detail":"Microsoft publishes hunting for next-server spawning shells and discovery tools.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","date":"2025-12-15","publisher":"Microsoft"}]},{"title":"Look for post-exploitation on app hosts","detail":"AWS and Wiz describe reconnaissance, files under /tmp, cloud credential theft, Sliver and XMRig.","sources":[{"url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","date":"2025-12-04","publisher":"AWS"},{"url":"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182","date":"2025-12-05","publisher":"Wiz"}]},{"title":"Rotate secrets if the app was unpatched","detail":"Next.js recommends rotating secrets for apps that were online and unpatched as of 4 Dec 2025, 13:00 PT.","sources":[{"url":"https://nextjs.org/blog/CVE-2025-66478","date":"2025-12-03","publisher":"Next.js"}]}],"queries":[{"id":"v2s-rh-spl-react2shell-headers","title":"RSC action headers since 4 Dec 2025","language":"spl","query":"index=* (sourcetype=access_combined OR sourcetype=nginx* OR sourcetype=aws:cloudfront:accesslogs OR sourcetype=cloudflare*) earliest=\"12/04/2025:00:00:00\"\n(\"next-action\" OR \"rsc-action-id\" OR \"resolved_model\" OR \"$@\")\n| stats count min(_time) as firstTime max(_time) as lastTime by host, clientip, uri\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Reverse-proxy / CDN access logs in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","sourceDate":"2025-12-04","license":"CC0 1.0","origin":"vuln2shell","notes":"Header names only appear if your proxy logs them.","tested":"untested","timeRange":"From 2025-12-04"},{"id":"v2s-rh-kql-react2shell-next-server","title":"next-server / node spawning shells since 4 Dec 2025","language":"kql","query":"DeviceProcessEvents\n| where Timestamp >= datetime(2025-12-04)\n| where InitiatingProcessFileName in~ (\"node\", \"node.exe\", \"next-server\")\n| where FileName in~ (\"sh\", \"bash\", \"dash\", \"curl\", \"wget\", \"nc\", \"ncat\", \"python\", \"python3\", \"cmd.exe\", \"powershell.exe\")\n| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName","logSource":"Microsoft Defender for Endpoint DeviceProcessEvents","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","sourceDate":"2025-12-15","license":"CC0 1.0","origin":"vuln2shell","notes":"Adapted from Microsoft's React2Shell hunting guidance.","tested":"untested","timeRange":"From 2025-12-04, limited by retention"},{"id":"v2s-rh-logscale-react2shell-node-child","title":"node spawning shells since 4 Dec 2025","language":"logscale","query":"// Set the time picker to start 2025-12-04\n#event_simpleName=ProcessRollup2 event_platform=Lin\n| ParentBaseFileName=/^(node|next-server)$/i\n| FileName=/^(sh|bash|dash|curl|wget|nc|ncat|socat|python3?)$/i\n| groupBy([aid, ComputerName, FileName, CommandLine], limit=max)","logSource":"CrowdStrike Falcon ProcessRollup2 (Linux)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","sourceDate":"2025-12-04","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2025-12-04"}],"thirdPartyQueries":[{"title":"Microsoft: Defending against React2Shell","url":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","author":"Microsoft","date":"2025-12-15","language":"kql","license":"see source","origin":"vendor","note":"Full advanced hunting set."},{"title":"Elastic: Suspicious React Server Child Process","url":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/initial_access_execution_susp_react_serv_child.toml","author":"Elastic","date":"2026-09-18","language":"eql","license":"Elastic License 2.0","origin":"vendor","note":"Already linked from Detection."}],"artefacts":[{"kind":"web-log","value":"POST with next-action or rsc-action-id headers","detail":"Exploit request shape.","sourceUrl":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","sourceDate":"2025-12-04"},{"kind":"web-log","value":"Request bodies containing $@ or status resolved_model","detail":"Exploit request shape.","sourceUrl":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","sourceDate":"2025-12-04"},{"kind":"process","value":"node or next-server spawning a shell or downloader","detail":"Post-exploitation.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","sourceDate":"2025-12-15"},{"kind":"file","value":"Unexpected files under /tmp on app hosts","detail":"Post-exploitation staging.","sourceUrl":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","sourceDate":"2025-12-04"}],"iocs":[],"iocNote":"AWS and GreyNoise published campaign IPs in their posts. Use those lists; they change quickly.","hitMeaning":[{"level":"attempt","detail":"RSC action headers with no process or file follow-on."},{"level":"likely-compromise","detail":"node / next-server spawning a shell, or unexpected /tmp writes after such a request."},{"level":"confirmed-compromise","detail":"Credential theft, miner or C2 framework on the host."}],"nextSteps":[{"title":"Patch and rotate","detail":"Upgrade React Server Components packages and Next.js, then rotate secrets.","links":[{"label":"React advisory","href":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"},{"label":"Next.js advisory","href":"https://nextjs.org/blog/CVE-2025-66478"}]},{"title":"Rebuild from clean images","detail":"Do not trust a host that ran a miner or C2."}],"limits":["Many proxies drop custom headers from logs.","Legitimate SSR can look noisy; focus on shell children."],"sources":[{"url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","date":"2025-12-04","publisher":"AWS"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","date":"2025-12-15","publisher":"Microsoft"},{"url":"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182","date":"2025-12-05","publisher":"Wiz"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"CVE-2025-55182 is unauthenticated RCE in React Server Components. Affected packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack in 19.0, 19.1.0, 19.1.1, 19.2.0. Fixed in 19.0.1, 19.1.2, 19.2.1. Next.js App Router 15.x / 16.x and 14.3.0-canary.77+ were also affected (CVE-2025-66478 later rejected as a duplicate). Next.js states 13.x, 14.x stable, Pages Router, and Edge Runtime are not affected.","checks":[{"id":"v2s-aia-react2shell-package-1","kind":"package","title":"List RSC packages and Next.js from the project lockfile","detail":"React and Microsoft: inspect node_modules or the lockfile for the three react-server-dom-* packages and next. Next.js also shipped npx fix-react2shell-next to check versions (it can also bump; use it as an inventory helper).","command":"npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack next","affectedMeans":"react-server-dom-* at 19.0.0, 19.1.0, 19.1.1, or 19.2.0. Next.js 15.0.0-15.0.4, 15.1.0-15.1.8, 15.2.0-15.2.5, 15.3.0-15.3.5, 15.4.0-15.4.7, 15.5.0-15.5.6, 16.0.0-16.0.6, or 14.3.0-canary.77 and later canaries. Apps that support RSC can be vulnerable even without Server Function endpoints.","fixedMeans":"react-server-dom-* at 19.0.1, 19.1.2, or 19.2.1 (or later in that line). Next.js at 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 (or later in that line), or Next 14.x stable after leaving a vulnerable canary. React: apps that do not use a server, or do not use an RSC-capable framework/bundler, are not affected per the 3 Dec 2025 advisory.","notes":"Later React blog updates list additional DoS/source-exposure CVEs and newer Next pins. For this RCE, use the 3 Dec 2025 React table and the Next.js CVE-2025-66478 fixed list. Do not send crafted Flight payloads.","sources":[{"url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","date":"2025-12-03","publisher":"React Team"},{"url":"https://nextjs.org/blog/CVE-2025-66478","date":"2025-12-03","publisher":"Next.js"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","date":"2025-12-15","publisher":"Microsoft"}]},{"id":"v2s-aia-react2shell-config-2","kind":"config","title":"Confirm App Router / RSC is in use","detail":"Next.js: applications using React Server Components with the App Router are the affected Next.js surface. Pages Router and Edge Runtime are vendor-stated not affected.","command":"ls app pages 2>/dev/null; grep -E '\"next\":' package.json","affectedMeans":"An app/ directory (App Router) on Next 15.x / 16.x or a vulnerable 14.3 canary, or another listed RSC framework (react-router unstable RSC, waku, @parcel/rsc, @vitejs/plugin-rsc, rwsdk) with unpatched react-server-dom-*.","fixedMeans":"Patched framework/package versions as in the version table, or a Next.js Pages Router / Edge-only / 13.x / 14.x stable app per the Next.js advisory.","sources":[{"url":"https://nextjs.org/blog/CVE-2025-66478","date":"2025-12-03","publisher":"Next.js"},{"url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","date":"2025-12-03","publisher":"React Team"}]},{"id":"v2s-aia-react2shell-exposure-3","kind":"exposure","title":"Find your own public Next.js hosts","detail":"Product query only. Version is not assessed.","command":"shodan search 'http.component:\"Next.js\" net:<your-range>'","affectedMeans":"A host in your range presents a Next.js component. Confirm the App Router package versions on that deployment.","fixedMeans":"No matching hosts, or matching hosts run a listed fixed Next.js / RSC package set.","notes":"Catalog Shodan count on 2026-10-23 is global. Shadowserver possibly-vulnerable counts used an active check; do not copy that methodology as an inventory command.","sources":[{"url":"https://www.shodan.io/search?query=http.component%3A%22Next.js%22","date":"2026-10-23","publisher":"Shodan (via catalog seenInTheWild)"}]}],"limits":["Bundled copies inside containers and serverless images need image rebuilds, not only a laptop npm ls.","CVE-2025-66478 detections are not false positives; NVD rejected it as a duplicate of CVE-2025-55182.","Do not POST crafted next-action / Flight bodies to test."],"sources":[{"url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","date":"2025-12-03","publisher":"React Team"},{"url":"https://nextjs.org/blog/CVE-2025-66478","date":"2025-12-03","publisher":"Next.js"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","date":"2025-12-15","publisher":"Microsoft"},{"url":"https://www.shodan.io/search?query=http.component%3A%22Next.js%22","date":"2026-10-23","publisher":"Shodan (via catalog seenInTheWild)"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"Next.js states there is no application workaround. React and hosting providers published temporary WAF rules. Treat those as an interim layer only.","items":[{"title":"Hosting-provider and WAF rules as an interim layer","detail":"React: worked with hosting providers on temporary mitigations; do not depend on them and still update immediately. Next.js: there is no workaround; upgrading to a patched version is required. Microsoft and AWS published WAF rule sets (Azure WAF custom rules; AWSManagedRulesKnownBadInputsRuleSet 1.24+).","limits":"Not a substitute for patching. Rules lag new payload permutations. Next.js states there is no application-level workaround.","verify":"Confirm the WAF managed/custom React2Shell rule is in block/deny for the hostname. Confirm the app's package versions separately with npm ls.","source":{"url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","date":"2025-12-03","publisher":"React Team"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"If the app was on the public internet while unpatched, Next.js tells you to rotate secrets. AWS and others documented China-nexus groups dropping miners and webshells after CVE-2025-55182.","containment":[{"title":"Patch RSC packages and Next.js, then rebuild from a clean image if the app was public while unpatched","detail":"React and Next.js: upgrade immediately. Catalog/Wiz: do not trust a host that ran a miner or C2. Rebuild rather than hot-patch a compromised Node process.","sources":[{"url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","date":"2025-12-03","publisher":"React Team"},{"url":"https://nextjs.org/blog/CVE-2025-66478","date":"2025-12-03","publisher":"Next.js"},{"url":"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182","date":"2025-12-03","publisher":"Wiz Research"}]},{"title":"Isolate app hosts that show node/next-server spawning shells","detail":"AWS and Microsoft: post-exploitation runs reconnaissance, writes under /tmp, and drops miners or C2. Take those nodes off the load balancer and preserve disk/memory.","sources":[{"url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","date":"2025-12-04","publisher":"AWS"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","date":"2025-12-15","publisher":"Microsoft"}]}],"rotate":[{"item":"All application secrets for apps that were online and unpatched as of 4 Dec 2025, 13:00 PT","reason":"Next.js (update 6 Dec 2025): strongly encourage rotating any secrets those apps use, starting with the most critical ones, after patching and redeploying.","sources":[{"url":"https://nextjs.org/blog/CVE-2025-66478","date":"2025-12-06","publisher":"Next.js"}]},{"item":"Cloud instance-metadata tokens (AWS, Azure, GCP, Tencent) and Kubernetes service-account credentials","reason":"Microsoft (15 Dec 2025): attackers queried IMDS endpoints and harvested K8s service-account credentials. Wiz: AWS credential identification and Base64 encoding for exfil.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","date":"2025-12-15","publisher":"Microsoft"},{"url":"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182","date":"2025-12-05","publisher":"Wiz Research"}]},{"item":"OpenAI API keys, Databricks tokens, Git credentials, and other secrets found by TruffleHog / Gitleaks-style harvest","reason":"Microsoft observed those secret-discovery tools and custom scripts after RCE, plus Azure CLI / azd token use.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","date":"2025-12-15","publisher":"Microsoft"}]}],"persistence":[{"kind":"account","value":"Newly added local users and enabled root login","detail":"Microsoft: attackers added new malicious users and enabled root login after React2Shell RCE.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","sourceDate":"2025-12-15"},{"kind":"path","value":"authorized_keys (SSH authorized_keys files on the app host)","detail":"Microsoft: attackers modified authorized_keys for persistence.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","sourceDate":"2025-12-15"},{"kind":"service","value":"MeshAgent and other RMM","detail":"Microsoft: RMM tools such as MeshAgent used for persistence.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","sourceDate":"2025-12-15"},{"kind":"other","value":"Bind mounts hiding malicious processes","detail":"Microsoft: bind mounts used to hide malicious processes and artefacts from system monitoring. Payloads included VShell, EtherRAT, SNOWLIGHT, ShadowPAD, and XMRig.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","sourceDate":"2025-12-15"},{"kind":"path","value":"Unexpected files under /tmp on app hosts","detail":"AWS: file writes to /tmp (honeypot example pwned.txt). Wiz: credential harvest and miner drops on victim Next.js apps and Kubernetes containers from 5 Dec 2025 06:00 UTC, including UPX-packed XMRig and Sliver.","sourceUrl":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","sourceDate":"2025-12-04"}],"evidence":[{"title":"Reverse-proxy and app logs with RSC action headers","detail":"AWS: POST requests with next-action or rsc-action-id headers, bodies containing $@ or status resolved_model. Preserve before rotation of CDN logs.","sources":[{"url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","date":"2025-12-04","publisher":"AWS"}]},{"title":"node / next-server child processes","detail":"Microsoft hunting: next-server/node spawning whoami, shells, encoded PowerShell, openssl, /dev/tcp. Preserve EDR for those hosts.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","date":"2025-12-15","publisher":"Microsoft"}]},{"title":"Cloud audit and IMDS access from the app identity","detail":"Microsoft and Wiz: IMDS token harvest and cloud credential use after RCE. Export CloudTrail / Azure activity / GCP logs for the instance role before disabling it.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","date":"2025-12-15","publisher":"Microsoft"},{"url":"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182","date":"2025-12-05","publisher":"Wiz Research"}]}],"sources":[{"url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","date":"2025-12-03","publisher":"React Team"},{"url":"https://nextjs.org/blog/CVE-2025-66478","date":"2025-12-03","publisher":"Next.js"},{"url":"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182","date":"2025-12-03","publisher":"Wiz Research"},{"url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","date":"2025-12-04","publisher":"AWS"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/","date":"2025-12-15","publisher":"Microsoft"},{"url":"https://nextjs.org/blog/CVE-2025-66478","date":"2025-12-06","publisher":"Next.js"},{"url":"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182","date":"2025-12-05","publisher":"Wiz Research"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Akamai","title":"CVE-2025-55182: React and Next.js server functions deserialization RCE","url":"https://www.akamai.com/blog/security-research/cve-2025-55182-react-nextjs-server-functions-deserialization-rce","date":"2025-12-03","cve":"CVE-2025-55182"},{"vendor":"AWS","title":"AWS Managed Rules changelog: Known bad inputs v1.24 (ReactJSRCE_BODY)","url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","date":"2025-12-04","cve":"CVE-2025-55182"},{"vendor":"Azure","title":"Application Gateway WAF DRS and CRS rule groups and rules","url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules","date":"2026-10-23","cve":"CVE-2025-55182"},{"vendor":"Cato Networks","title":"'React2Shell' vulnerability targeting React Server Components","url":"https://www.catonetworks.com/blog/cato-ctrl-react2shell-vulnerability-targeting-react-server-components/","date":"2025-12-09","cve":"CVE-2025-55182"},{"vendor":"Cato Networks","title":"Rapid CVE Mitigation by Cato Security Research","url":"https://www.catonetworks.com/rapid-cve-mitigation/","date":"2026-10-23","cve":"CVE-2025-55182","dateKind":"checked"},{"vendor":"Check Point","title":"CPAI-2025-7812 React Server Components Remote Code Execution (CVE-2025-55182)","url":"https://advisories.checkpoint.com/defense/advisories/public/2025/cpai-2025-7812.html","date":"2025-12-04","cve":"CVE-2025-55182"},{"vendor":"Cisco Talos","title":"Snort Talos Rules 2025-12-04","url":"https://www.snort.org/advisories/talos-rules-2025-12-04-12-4-2025","date":"2025-12-04","cve":"CVE-2025-55182"},{"vendor":"Citrix","title":"NetScaler signature update version 166","url":"https://docs.netscaler.com/us/en/citrix-adc/current-release/signature-alerts/signature-update-version-166.html","date":"2026-10-23","cve":"CVE-2025-55182","dateKind":"checked"},{"vendor":"Cloudflare","title":"Cloudflare emergency WAF release 2025-12-03","url":"https://developers.cloudflare.com/changelog/post/2025-12-03-emergency-waf-release/","date":"2025-12-03","cve":"CVE-2025-55182"},{"vendor":"F5","title":"F5 provides enhanced protections against React vulnerabilities","url":"https://www.f5.com/company/blog/f5-provides-enhanced-protections-against-react-vulnerability-cve-2025-55182","date":"2025-12-04","cve":"CVE-2025-55182, CVE-2025-66478"},{"vendor":"F5","title":"F5 Distributed Cloud attack signatures reference","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2025-12-11","cve":"CVE-2025-55182, CVE-2025-66478"},{"vendor":"Fastly","title":"Protection from CVE-2025-55182 (React) and CVE-2025-66478 (Next.js)","url":"https://www.fastly.com/documentation/reference/changes/2025/12/added-virtual-patch-for-cve-2025-66478/","date":"2025-12-03","cve":"CVE-2025-55182, CVE-2025-66478"},{"vendor":"Fastly","title":"CVE-2025-55182 virtual patch enabled by default","url":"https://www.fastly.com/documentation/reference/changes/2025/12/immediate-blocking-for-cve-2025-55182/","date":"2025-12-05","cve":"CVE-2025-55182"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2025-55182","url":"https://www.fortiguard.com/search?q=CVE-2025-55182&engine=1","date":"2025-12-02","cve":"CVE-2025-55182, CVE-2025-66478"},{"vendor":"Fortinet","title":"FortiGuard Outbreak Alert: React2Shell RCE","url":"https://www.fortiguard.com/outbreak-alert/react2shell-rce","date":"2026-10-23","cve":"CVE-2025-55182","dateKind":"checked"},{"vendor":"Google Cloud","title":"Cloud Armor release notes","url":"https://docs.cloud.google.com/armor/docs/release-notes","date":"2025-12-03","cve":"CVE-2025-55182"},{"vendor":"Imperva","title":"Imperva customers protected against React Server Components (RSC) vulnerability","url":"https://www.imperva.com/blog/imperva-customers-protected-against-react-server-components-rsc-vulnerability/","date":"2025-12-04","cve":"CVE-2025-55182"},{"vendor":"Juniper","title":"HTTP:CTS:META-JS-INSEC-DSRLIZ","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:META-JS-INSEC-DSRLIZ.html","date":"2026-01-02","cve":"CVE-2025-55182"},{"vendor":"Netskope","title":"SERVER-WEBAPP React Server Components remote code execution attempt (library entry, undated)","url":"https://threatlabs.netskope.com/library/ips/server-webapp-react-server-components-remote-code-execution-attempt/","date":"2026-10-23","cve":"CVE-2025-55182","dateKind":"checked"},{"vendor":"OWASP CRS","title":"coreruleset v4.22.0 release","url":"https://github.com/coreruleset/coreruleset/releases/tag/v4.22.0","date":"2026-01-05","cve":"CVE-2025-55182"},{"vendor":"Palo Alto Networks","title":"Exploitation of critical vulnerability in React Server Components (CVE-2025-55182)","url":"https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/","date":"2025-12-12","cve":"CVE-2025-55182, CVE-2025-66478"},{"vendor":"Radware","title":"React2Shell, a CVSS 10.0 RCE vulnerability in React Server Components (CVE-2025-55182)","url":"https://www.radware.com/security/threat-advisories-and-attack-reports/react2shell-a-cvss-10-0-rce-vulnerability-in-react-server-components-cve-2025-55182/","date":"2025-12-05","cve":"CVE-2025-55182, CVE-2025-66478"},{"vendor":"Sophos","title":"Sophos IPS signature update 18.24.24","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.24.24.html","date":"2025-12-09","cve":"CVE-2025-55182"},{"vendor":"Trend Micro","title":"SECURITY ALERT: Critical Security Vulnerability in React Server Components (CVE-2025-55182)","url":"https://success.trendmicro.com/en-US/solution/ka-0021831","date":"2025-12-05","cve":"CVE-2025-55182","dateKind":"checked"},{"vendor":"Zscaler","title":"React2Shell remote code execution vulnerability (CVE-2025-55182)","url":"https://www.zscaler.com/blogs/security-research/react2shell-remote-code-execution-vulnerability-cve-2025-55182","date":"2025-12-08","cve":"CVE-2025-55182"}],"coverage":[{"title":"Critical Security Vulnerability in React Server Components","publisher":"React Team","url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","date":"2025-12-03","type":"vendor"},{"title":"Security Advisory: CVE-2025-66478","publisher":"Next.js","url":"https://nextjs.org/blog/CVE-2025-66478","date":"2025-12-03","type":"vendor"},{"title":"China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182)","publisher":"AWS Security Blog","url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","date":"2025-12-04","type":"research"},{"title":"React2Shell (CVE-2025-55182): Everything You Need to Know","publisher":"Wiz Research","url":"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182","date":"2025-12-03","type":"research"},{"title":"CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild","publisher":"GreyNoise","url":"https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far","date":"2025-12-05","type":"research"},{"title":"React2Shell (CVE-2025-55182)","publisher":"Lachlan Davidson","url":"https://react2shell.com/","date":"2025-12-03","type":"research"}],"posts":[],"research":[{"title":"React Team advisory","url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","authors":"React Team","date":"2025-12-03"},{"title":"Next.js advisory CVE-2025-66478","url":"https://nextjs.org/blog/CVE-2025-66478","authors":"Sebastian Markbage, Josh Story","date":"2025-12-03"},{"title":"NVD CVE-2025-55182","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55182","authors":"NVD","date":"2025-12-03"},{"title":"AWS MadPot exploitation report","url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","authors":"AWS","date":"2025-12-04"},{"title":"Wiz Research analysis","url":"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182","authors":"Wiz Research","date":"2025-12-03"},{"title":"react2shell.com (discoverer)","url":"https://react2shell.com/","authors":"Lachlan Davidson","date":"2025-12-03"}],"impact":{"kind":"framework","frameworks":[{"framework":"react-server-dom-webpack / parcel / turbopack","status":"affected","versions":"19.0.1, 19.1.2, 19.2.1","vendorStatement":{"date":"2025-12-03","url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","quote":"The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0. A fix was introduced in versions 19.0.1, 19.1.2, and 19.2.1."}},{"framework":"Next.js App Router","status":"affected","versions":"15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7","vendorStatement":{"date":"2025-12-03","url":"https://nextjs.org/blog/CVE-2025-66478","quote":"Applications using React Server Components with the App Router are affected when running Next.js 15.x, 16.x, and 14.3.0-canary.77 and later canary releases. Next.js 13.x, Next.js 14.x stable, Pages Router applications, and the Edge Runtime are not affected."}},{"framework":"React Router (unstable RSC APIs)","status":"affected","versions":"latest packages per React advisory","vendorStatement":{"date":"2025-12-03","url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","quote":"The following React frameworks and bundlers are affected: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk."}},{"framework":"Waku / Parcel RSC / Vite RSC plugin / RedwoodSDK","status":"affected","versions":"latest packages per React advisory","vendorStatement":{"date":"2025-12-03","url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","quote":"The following React frameworks and bundlers are affected: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk."}}]},"pocs":[{"title":"Original React2Shell PoCs","url":"https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc","source":"Lachlan Davidson (lachlan2k)","validationStatus":"validated","validationDate":"2025-12-05","notes":"Discoverer-published original PoCs. Created 5 Dec 2025. AWS and Wiz note many other public PoCs are invalid or require unsafe server manifests."}],"_feed":{"page":"https://vuln2shell.com/vulns/react2shell","json":"https://vuln2shell.com/vulns/react2shell.json","iocsCsv":"https://vuln2shell.com/vulns/react2shell/iocs.csv","stix":"https://vuln2shell.com/vulns/react2shell/stix.json"}}