React2Shell (CVE-2025-55182): Early exploitation and real-world impact

•By FNB Solutions Engineering Team

Early exploitation observations and incident response notes

Following the public disclosure of CVE-2025-55182 (commonly referred to as React2Shell), FNB Solutions investigated active exploitation targeting Internet-exposed React and Next.js deployments that implement React Server Components (RSC).

Exploitation activity began almost immediately after disclosure. Attacks were automated and opportunistic, focusing on applications exposing endpoints capable of processing RSC Flight requests. In multiple incidents we assisted with, exploitation progressed beyond proof-of-concept execution and resulted in complete compromise of the affected execution environment, and in some cases the underlying host.

Confirmed real-world impact

FNB Solutions has assisted multiple teams affected by active exploitation of CVE-2025-55182. Observed outcomes included:

  • Unauthenticated remote code execution within Node.js application processes
  • Compromise of application containers
  • Privilege escalation driven by insecure container configurations (over-privileged containers, writable host mounts, exposed Docker sockets)
  • Deployment of cryptocurrency mining malware following initial access
  • Sustained CPU and memory abuse resulting in service degradation and instability

In several incidents, attackers used the initial React2Shell execution primitive to retrieve and execute secondary payloads, establish persistence within containers, and, where isolation controls were weak, pivot to the underlying host. Affected environments were identified through broad Internet scanning rather than targeted intrusion.

Technical summary

CVE-2025-55182 is a remote code execution vulnerability caused by unsafe deserialization in the React Server Components (RSC) Flight protocol implementation.

The RSC Flight protocol requires servers to deserialize structured, attacker-supplied payloads. Due to insufficient validation during deserialization, specially crafted input can cause arbitrary JavaScript objects, including executable functions, to be instantiated as part of the deserialization process.

This behavior enables an unauthenticated remote attacker to execute arbitrary JavaScript code within the server’s Node.js runtime, with the privileges of the application process.

Key characteristics:

  • No authentication required
  • No user interaction required
  • Single-request exploitation
  • Arbitrary server-side JavaScript execution

The vulnerability exists at the protocol and deserialization layer and is independent of application-specific business logic or user-defined server actions.

Exploitation behavior observed

Across incidents investigated by FNB Solutions, attackers followed a consistent exploitation workflow:

  1. Internet-wide scanning to identify React and Next.js applications
  2. Identification of endpoints capable of processing RSC Flight payloads
  3. Delivery of crafted serialized payloads to trigger unsafe deserialization
  4. Immediate execution of arbitrary JavaScript code within the server process
  5. Retrieval and execution of secondary payloads
  6. Persistence via container filesystem modification or startup hooks

Compromised systems consistently exhibited clear indicators of compromise, including abnormal CPU utilization, unexpected outbound network connections, and unknown Node.js child processes.

Post-exploitation activity observed

Following successful exploitation, attackers deployed additional tooling to monetize access, maintain persistence, and expand control within compromised environments.

Observed post-exploitation activity included:

  • Shell scripts used to retrieve and execute cryptocurrency mining software from public repositories
  • Linux backdoors providing long-term persistence via system services and process masquerading
  • Outbound reverse proxy tooling used to establish attacker-controlled access paths that bypass inbound firewall controls
  • Custom Linux ELF binaries supporting interactive command execution, file manipulation, and network pivoting
  • Dropper scripts responsible for deploying command-and-control tooling
  • Self-updating loader scripts capable of replacing and restarting deployed payloads
  • DDoS-capable malware with remote administration, persistence, and evasion features

Detailed payload identifiers and tooling names observed during these incidents are omitted here. They are available on request for incident response and security teams with a legitimate operational need.

Related RSC vulnerabilities

Additional vulnerabilities disclosed during the same timeframe (including CVE-2025-55183 and CVE-2025-55184) affect related aspects of React Server Components handling. While technically distinct, these issues stem from similar assumptions around server-side payload processing and insufficient validation.

From a defensive perspective, these vulnerabilities should be treated as part of a shared attack surface: any server endpoint that deserializes and processes RSC-related input.

Defensive guidance

For teams operating React-based applications that implement React Server Components:

  • Patch or upgrade all affected React and framework versions immediately

  • Review container security assumptions:

    • Avoid privileged containers
    • Minimize writable host mounts and Linux capabilities

  • Monitor for post-exploitation indicators:

    • Unexpected CPU or memory usage
    • Unknown processes or child Node.js runtimes
    • Suspicious outbound network traffic
    • Changes to container images, startup scripts, or scheduled tasks

If cryptocurrency mining activity is detected, treat it as evidence of arbitrary code execution and potential lateral movement, not as an isolated cleanup issue.

Closing note

Exploitation of CVE-2025-55182 requires no authentication, no user interaction, and no exploit chaining beyond exposed RSC Flight handling. Environments that combine Internet-exposed RSC endpoints with weak container isolation are at high risk of full compromise.