React2Shell: In-the-Wild Exploitation Expected for Critical React Vulnerability
Source SecurityWeek
Exploited in the wild · KEV due 12 Dec 2025 · public exploit available (Metasploit, Exploit-DB) : apply the vendor's fix or mitigations to react-server-dom-webpack now.
Data as of 5 Dec 2025, 04:40 UTC
- KEV deadline
- US federal agencies must patch by this date; a sensible deadline for everyone else.
Exploitation evidence
t = 0 is the CVE’s publication on cve.org
Disclosed: evidence found.
CVE published 3 Dec 2025
Detectable: evidence found.
nuclei template: React Server Components - Remote Code Execution
Weaponised: evidence found.
1 Metasploit module · 1 Exploit-DB entry, 127 days after disclosure
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 2 days after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
Timeline
CVE ID reserved
by Meta
, 117 days before disclosure
CVE published
on cve.org
, t = 0
In Threat Radar
record ingested
, 14 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed · ransomware use known
, 2 days after disclosure
KEV remediation due
US federal deadline
, 9 days after disclosure
First Exploit-DB entry (opens in a new tab)
React Server 19.2.0 - Remote Code Execution
, 127 days after disclosure
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Metareact-server-dom-webpack | Affected
| Fixed in– |
| Metareact-server-dom-turbopack | Affected
| Fixed in– |
| Metareact-server-dom-parcel | Affected
| Fixed in– |
npmreact-server-dom-parcelpkg:npm/react-server-dom-parcelOther threats | Affected
| Fixed in– |
npmreact-server-dom-turbopackpkg:npm/react-server-dom-turbopackOther threats | Affected
| Fixed in– |
npmreact-server-dom-webpackpkg:npm/react-server-dom-webpackOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
1. Immediately inventory all React applications to identify those using the newer feature implicated in CVE-2025-55182. 2. Monitor official React and security advisories for patches or updates addressing this vulnerability and apply them as soon as they become available. 3. Conduct code reviews focusing on the usage of new React features to identify potential exposure points. 4. Implement Web Application Firewalls (WAFs) with updated rules to detect and block exploit attempts targeting this vulnerability. 5. Enhance logging and monitoring to detect unusual activity indicative of exploitation attempts, such as unexpected code execution or anomalous network traffic. 6. Isolate critical systems and apply the principle of least privilege to limit the potential impact of a successful exploit. 7. Educate development and security teams about the vulnerability to ensure rapid response and remediation. 8. Consider temporary mitigations such as disabling or restricting the use of the new React feature if feasible until patches are deployed.
Description
A researcher has pointed out that only instances using a newer feature are impacted by CVE-2025-55182. The post React2Shell: In-the-Wild Exploitation Expected for Critical React Vulnerability appeared first on SecurityWeek .