Guides | 003: React2Shell and the Quiet Art of Not Being .Pwned

URGENT: Apply Patch ASAP as Security Exploit for React has Millions Affected

A critical vulnerability in React Server Components, CVE-2025-55182, now known as React2Shell, has been under active exploitation for the past four days. The flaw is elegant in its brutality: an unsafe deserialization path in the RSC payload parser that permits an unauthenticated caller to execute arbitrary code on the server with the same serene confidence that legitimate actions enjoy. CVSS 10.0. One does not often see a perfect score outside of Olympic gymnastics and nuclear disarmament treaties.

The vulnerability was disclosed privately to Meta on 29 November by Lachlan Davidson, reached public proof-of-concept on 3 December, and by the following morning several People’s Republic-aligned groups had already incorporated it into their standard intrusion kits. Amazon’s threat intelligence teams have observed sustained exploitation against financial, governmental, and cloud-native targets. Some campaigns are fully automated; others betray the patient hand of an operator who clearly enjoys his work... one actor attempted refinement of a single payload 116 times in under an hour, the digital equivalent of a safecracker listening for tumblers.

More than fifty million sites and applications ship the affected React 19.0.0–19.2.0 and Next.js 15/16 ranges. The exposure surface is, in the understated parlance of our trade, non-trivial.

At Thunderwerx we deploy React/Next.js exclusively on Vercel. Their response was characteristically swift: a patch landed within hours of disclosure, followed by runtime mitigations that do not require customer intervention. Our own builds were refreshed the same day; telemetry remains uneventful. One of the small mercies of trusting competent platform teams is that occasionally the apocalypse is downgraded to a minor inconvenience.

For those still exposed: upgrade to React 19.2.1 or Next.js 16.0.1 at minimum. Treat every Server Actions endpoint as though it were a loaded revolver pointed at your process, because for the moment it is. Web-application firewalls can blunt the obvious sprays, but they are no substitute for eliminating the deserialization trap itself.

There is a certain dark poetry in watching a technology admired for its restraint and performance become the vector for such unrestrained compromise. React did not intend to ship a shell, yet here we are. The lesson, as ever, is that elegance in software is only admirable when it is matched by an equal elegance in threat modelling.

We will continue to monitor indicators shared by the usual suspects ie- Datadog’s public repository of offending ranges has proven useful and adjust defences as the exploitation playbook evolves.

Should you find yourself in need of a second opinion on your own posture, the door is open for you, reach out here.

Until next time, thanks for reading - please share to those affected (many)

Thunderwerx