React2Shell (CVE-2025-55182): What Every Organization Must Know

A new major security threat React2Shell, officially tracked as CVE-2025-55182 is putting thousands of applications worldwide at risk. Rated a maximum severity 10.0, this vulnerability allows attackers to take full control of vulnerable servers without needing any login or permission.

If your organization uses React version 19.x and above; or Next.JS 14.3, 15.x ,16.x and above; or applications built using React Server Components, this vulnerability may affect you.

At SecureDots, we want businesses, startups, and IT teams to understand what this threat means and update to the recommended version immediately.

Which Versions Are Affected?

Any organization using the following is vulnerable:

React 19.x Including packages like:

• react-server-dom-webpack

• react-server-dom-parcel

• react-server-dom-turbopack

Next.js versions

• 14.3.0-canary.77 and above

• All versions 15.x

• All versions 16.x

Even if your app does not use server actions, it is still vulnerable as long as React Server Components are enabled (default in many apps).

What Exactly Is React2Shell (CVE-2025-55182) ? 

React2Shell is a flaw inside the React Server Components (RSC) system. Because of a weakness in how data is processed (unsafe deserialization), an attacker can send a malicious request to your application and force your server to run any command they want.

In simple words: If your app uses affected React/Next.js versions, an attacker could take control of your server with just one malicious request. This includes reading sensitive files, stealing data, shutting down your system, or installing malware.

Why Your Organization Should Care

React2Shell(CVE-2025-55182) is not a theoretical risk. It is already being exploited globally. Here’s why it must be treated as a high-priority business risk:

1. Active Attacks Started Within Hours

Based on cloud compute service providers; government-linked threat groups (especially from China) began exploiting the vulnerability within hours of public disclosure.

Groups like Earth Lamia and Jackpot Panda known for targeting finance, logistics, retail, universities, and governments—have been actively scanning for unpatched systems.

This shows how fast attackers move today.

2. Easy to Exploit — No Skill Needed

Once public proof-of-concept (PoC) code became available, even low-skilled attackers could use automated tools to:

• run server commands

• check user identities (whoami, id)

• access files like `/etc/passwd`

• move inside the organization’s network

This is why thousands of attacks are happening right now.

3. The probability of your organization’s with Affected Version - know or unknow

According to hosting provider Wiz Research:

• 69% of cloud environments have Next.js

• 61% of those Next.js apps are publicly accessible

• 44% of cloud environments are exposed and vulnerable

This means nearly half of all cloud apps worldwide could be at risk.

What You Should Do Immediately

At SecureDots, we strongly recommend taking immediate action:

1. Patch Immediately

• Update React/Next.js to the latest fixed versions.

• Cloud WAF rules from AWS, Google, or Cloudflare are not enough

2. Review Server & Application Logs

Look for suspicious signs like:

• HTTP requests with headers such as next-action or rsc-action-id

• Unexpected commands running on your server

• Unusual file-reading attempts

 3. Conduct a Quick Security Audit

• A rapid VAPT (Vulnerability Assessment & Penetration Testing) can help confirm whether attackers have already exploited your system.

In Simple Terms: This Is a “Fix It Now” Vulnerability

React2Shell is one of the most severe web vulnerabilities in recent years. It is easy to exploit, massively widespread, and already being used by state-sponsored threat actors.

If your company uses React or Next.js, this is not a “wait and watch” situation. This is an immediate action scenario.

Need Help Securing Your Application?

SecureDots can perform a rapid React2Shell security check for your application within 24 hours.

Contact us

How SecureDots Can Help Your Organization

As a cybersecurity startup specializing in penetration testing and vulnerability assessment, SecureDots offers:

• Immediate React2Shell exposure analysis

• Fast VAPT & application security audit

• Patch validation

• Threat detection & log analysis

• Emergency remediation support

• Custom recommendations for your tech stack

We ensure your systems are secure, compliant, and protected from live attacks.

Stay safe. Stay secure.

Team SecureDots