Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

React2Shell (CVE-2025-55182): Node.js RCE Against a Production Next.js App

hunt.io | vulnerability | Critical | Actively exploited | CVE-2025-55182 | #rce | #vulnerability | #nextjs | #cve-2025-55182 | #react | #nodejs

Summary

A log-level reconstruction of CVE-2025-55182 (React2Shell) on a live Next.js app: RCE via the RSC Flight protocol, 12,440 logs, four C2 servers—though a stripped container blocked later stages.
CVE
CVE-2025-55182
CVSS
10
Published
Collected

original ↗

Related coverage

Critical · vulnerability · xbow.com
React2Shell (CVE-2025-55182): A Wake-Up Call for Modern Web Security and How XBOW Helps You Respond
Covers React2Shell (CVE-2025-55182), an unauthenticated RCE in React Server Components' serialization that also affects Next.js and more, and how to quickly scope exposure.
Critical · vulnerability · hackerone.com
CVE-2025-55182: Unauthenticated React Exploit Affects Millions of Sites
A critical CVE-2025-55182 React RCE flaw affects millions of sites. Get impact details, affected versions, indicators of compromise, and urgent remediation steps.
Critical · vulnerability · bugcrowd.com
CVE-2025-55182: What you need to know about React2Shell
The React team disclosed CVE-2025-55182, an unauthenticated RCE in React Server Components used by Next.js. Bugcrowd has activated priority triage for related submissions.
vulnerability · wiz.io
React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability
React2Shell (CVE-2025-55182) is a critical unauthenticated RCE in React Server Components, exploitable in default Next.js deployments. Wiz confirms active exploitation and urges immediate patching.
research · wiz.io
React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182
Wiz details CVE-2025-55182 exploit mechanics—insecure deserialization in React Server Components—and maps in-the-wild attacks from cryptomining and credential harvesting to Sliver backdoors.
vulnerability · wiz.io
Protecting Against Zero-Day Vulnerabilities with SOC-Level ASM Alert
Wiz adds Validated External Risk Issues: SOC-level alerts for externally verified attack paths, shown via React2Shell (CVE-2025-55182/66478), where half of exposed customers showed compromise signs.
back