Due to indications of extensive exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has asked federal agencies to patch the latest React2Shell vulnerability by December 12, 2025.
The React Server Components (RSC) Flight protocol is impacted by the major vulnerability, identified as CVE-2025-55182 (CVSS score: 10.0). Unsafe deserialization, which enables an attacker to insert malicious code that the server runs in a privileged context, is the root cause of the problem. Other frameworks, such as Next.js, Waku, Vite, React Router, and RedwoodSDK, are also impacted.
According to Cloudforce One, Cloudflare’s threat intelligence team, a single, carefully constructed HTTP request is adequate; there is no need for user interaction, authentication, or higher permissions. Once successful, the attacker can use the compromised server to run arbitrary read more about React2Shell Exploitation Escalates into Large-Scale Global Attacks Forcing Emergency Mitigation.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.