React Vulnerability Exploited by Hackers Worldwide

A critical vulnerability in React Server Components, disclosed on December 3, 2025, has led to widespread exploitation by cybercriminals and state-backed hackers targeting websites worldwide, including cryptocurrency platforms where attackers are draining user wallets.

The flaw, tracked as CVE-2025-55182 and dubbed React2Shell, enables unauthenticated remote code execution on affected servers. React maintainers rated it at the maximum severity of CVSS 10.0, stemming from an insecure deserialization issue in the RSC Flight protocol, which handles server-client state exchanges. Attackers can send a specially crafted HTTP request to a server's function endpoint, tricking it into running arbitrary JavaScript code with the web server's privileges. This affects React versions 19.0 through 19.2.0, including packages in frameworks like Next.js, React Router, Waku, Vite, Parcel, and RedwoodJS. Patched versions, such as 19.0.1, 19.1.2, and 19.2.1 for react-server-dom packages, were released shortly after disclosure.

Exploitation began within hours of the announcement. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities...