CVE-2025-55182 — React Server Components Remote Code Execution (React2Shell)

Key facts

CVE-2025-55182 is a Critical (10.0) vulnerability: React Server Components Remote Code Execution (React2Shell). This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-12-05), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

Actively exploited — on the CISA KEV catalog

CVE-2025-55182 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-12-05), confirming exploitation in the wild. It is linked to known ransomware campaigns. Federal remediation deadline: 2025-12-12. Prioritise patching and deploy the detection and prevention rules below.

CVE	CVE-2025-55182
Severity	Critical (10.0)
CISA KEV	Actively exploited (added 2025-12-05) · ransomware
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2025/CVE-2025-55182/

Details

CVE-2025-55182 is a Critical (10.0) vulnerability: React Server Components Remote Code Execution (React2Shell). This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

Overview

Attribute	Value
CVE ID	CVE-2025-55182
Severity	Critical
CVSS Score	10.0
Affected Product	React Server Components (RSC)
Vulnerability Type	Remote Code Execution
Exploitation Status	Actively Exploited

Description

CVE-2025-55182, dubbed "React2Shell," is a critical remote code execution vulnerability in React Server Components (RSC). The flaw allows unauthenticated attackers to execute arbitrary code on affected servers by exploiting improper deserialization of payloads sent to React Server Function endpoints.

Affected Versions

• React 19.0.0 - 19.1.0 (with RSC enabled)
• Next.js 14.0.0 - 15.1.0 (App Router with Server Actions)
• Any framework using React Server Components

Technical Details

Root Cause

The vulnerability exists in how React decodes and processes serialized payloads from client requests to Server Functions. The deserialization process fails to properly validate input, allowing attackers to inject malicious payloads that execute arbitrary code on the server.

Attack Vector

1. Attacker crafts a malicious serialized payload
2. Payload is sent to a Server Function endpoint
3. Server deserializes the payload without proper validation
4. Arbitrary code executes with server privileges

Impact

• Remote Code Execution: Full server compromise
• Data Breach: Access to sensitive data and credentials
• Lateral Movement: Pivot point for further attacks
• Estimated Affected Sites: 12+ million websites

Exploitation

Active exploitation observed since December 5, 2025. Threat actors deploying: - Cryptocurrency miners - Credential harvesters - Sliver implants/backdoors

Mitigation

Immediate Actions

1. Upgrade React to version 19.1.1 or later
2. Upgrade Next.js to version 15.1.1 or later
3. Apply WAF rules to block malicious payloads

Long-term Recommendations

• Implement input validation on all Server Functions
• Enable Content Security Policy (CSP)
• Monitor for suspicious server activity
• Regular security audits of RSC implementations

Verification Process

The PoC uses a multi-stage verification approach:

Step 1: Product/Version Detection (Passive)

[*] Query target endpoint
[*] Detect product signatures and extract version
[*] Check if version is in vulnerable range

Step 2: Active Vulnerability Testing

Method	Description	Detection
Error-based	Tests for error messages indicating vulnerability	Error indicators in response
Timing-based	Measures response delay with payload	Response time significantly longer
Response-based	Checks for expected patterns in response	Vulnerability indicators present

Verification Flow

┌─────────────────────────────────────────────────────────────┐
│                    Product Detection                         │
│  Query target → Detect product/version                      │
│  Check if version in vulnerable range                       │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│               Active Vulnerability Testing                   │
│                                                              │
│  1. Error-based Test                                         │
│     └─ Send payload → Check for error indicators            │
│     └─ If error found → CONFIRMED VULNERABLE                │
│                                                              │
│  2. Timing-based Test                                        │
│     └─ Send delay payload → Measure response time           │
│     └─ If delayed → CONFIRMED VULNERABLE                    │
│                                                              │
│  3. Response-based Test                                      │
│     └─ Send payload → Check response content                │
│     └─ If pattern matches → CONFIRMED VULNERABLE            │
└─────────────────────────────────────────────────────────────┘

Usage

# Full vulnerability check (version + active testing)
python3 poc.py -t https://target.com -c

# Version-only check (passive, no payloads sent)
python3 poc.py -t https://target.com -c --version-only

References

• Microsoft Security Blog - Defending against React2Shell
• Unit42 - Exploitation Analysis
• CISA KEV Catalog
• Wiz Research - React2Shell Analysis

Timeline

Date	Event
2025-12-05	First exploitation observed
2025-12-10	Vulnerability publicly disclosed
2025-12-12	CISA adds to KEV catalog
2025-12-15	Patches released
2025-12-26	Federal agency remediation deadline

Detection and prevention

Ready-to-deploy defensive rules for CVE-2025-55182, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Apache HTTPD mitigation — prevention/httpd.conf
• Detection-only PoC — poc.py

References: NVD — CVE-2025-55182 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2025-55182 - Snort Detection Rules
# React2Shell (React Server Components RCE)

# Alert on RSC exploit payload patterns
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-55182 React2Shell Exploit Attempt - Malicious RSC Payload";
    flow:to_server,established;
    content:"text/x-component";
    http_header;
    content:"__rsc_type";
    content:"function_reference";
    distance:0;
    within:100;
    classtype:web-application-attack;
    sid:2025551820;
    rev:1;
    metadata:cve CVE-2025-55182, severity critical;
)

# Detect prototype pollution attempt in RSC
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-55182 React2Shell - Prototype Pollution Attempt";
    flow:to_server,established;
    content:"RSC|3a| 1";
    http_header;
    content:"__proto__";
    http_client_body;
    content:"constructor";
    distance:0;
    within:50;
    classtype:web-application-attack;
    sid:2025551821;
    rev:1;
    metadata:cve CVE-2025-55182, severity critical;
)

# Detect eval injection in RSC closure
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-55182 React2Shell - Eval Injection";
    flow:to_server,established;
    content:"text/x-component";
    http_header;
    content:"__rsc_closure";
    http_client_body;
    pcre:"/eval|Function\s*\(|setTimeout|setInterval/i";
    classtype:web-application-attack;
    sid:2025551822;
    rev:1;
    metadata:cve CVE-2025-55182, severity critical;
)

# Detect suspicious Next-Action header
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-55182 React2Shell - Suspicious Next-Action Header";
    flow:to_server,established;
    content:"Next-Action|3a|";
    http_header;
    pcre:"/Next-Action:\s*[A-Za-z0-9+\/=]{64,}/Hi";
    classtype:web-application-attack;
    sid:2025551823;
    rev:1;
    metadata:cve CVE-2025-55182, severity high;
)

# Detect RSC deserialization attack
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-55182 React2Shell - Deserialization Attack";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"RSC|3a| 1";
    http_header;
    pcre:"/0:\{.*payload.*[A-Za-z0-9+\/=]{100,}/s";
    classtype:web-application-attack;
    sid:2025551824;
    rev:1;
    metadata:cve CVE-2025-55182, severity critical;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2025-55182 - YARA Detection Rules
 * React2Shell (React Server Components RCE)
 */

rule CVE_2025_55182_React2Shell_Payload {
    meta:
        description = "Detects CVE-2025-55182 React2Shell exploit payload"
        author = "Security Research Team"
        date = "2025-12"
        cve = "CVE-2025-55182"
        severity = "critical"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-55182"

    strings:
        $rsc_type = "__rsc_type" ascii wide
        $func_ref = "function_reference" ascii wide
        $rsc_closure = "__rsc_closure" ascii wide
        $eval_pattern = /eval\s*\(/ ascii wide
        $proto_pollution = "__proto__" ascii wide
        $constructor = "constructor" ascii wide

        // Base64 encoded variants
        $b64_rsc_type = "X19yc2NfdHlwZQ" ascii  // __rsc_type
        $b64_eval = "ZXZhbA" ascii  // eval

    condition:
        (($rsc_type and $func_ref) or
         ($rsc_closure and $eval_pattern) or
         ($proto_pollution and $constructor and $rsc_type)) or
        ($b64_rsc_type and $b64_eval)
}

rule CVE_2025_55182_Exploit_Script {
    meta:
        description = "Detects React2Shell exploit scripts"
        author = "Security Research Team"
        date = "2025-12"
        cve = "CVE-2025-55182"
        severity = "high"

    strings:
        $import1 = "import requests" ascii
        $import2 = "from urllib" ascii
        $cve_ref = "CVE-2025-55182" ascii nocase
        $react2shell = "react2shell" ascii nocase
        $rsc_header = "text/x-component" ascii
        $next_action = "Next-Action" ascii
        $exploit_func = /def\s+exploit\s*\(/ ascii

    condition:
        ($cve_ref or $react2shell) and
        ($rsc_header or $next_action) and
        ($import1 or $import2)
}

rule CVE_2025_55182_Malicious_RSC_Request {
    meta:
        description = "Detects malicious RSC HTTP request patterns"
        author = "Security Research Team"
        date = "2025-12"
        cve = "CVE-2025-55182"
        severity = "critical"

    strings:
        $http_post = "POST" ascii
        $content_type = "Content-Type: text/x-component" ascii nocase
        $rsc_header = "RSC: 1" ascii nocase
        $payload_start = /0:\{.*"payload"/ ascii
        $malicious_json = /"__rsc_closure".*"type".*"eval"/ ascii

    condition:
        $http_post and $rsc_header and
        ($payload_start or $malicious_json)
}

rule CVE_2025_55182_Webshell_Indicator {
    meta:
        description = "Detects webshells deployed via React2Shell"
        author = "Security Research Team"
        date = "2025-12"
        cve = "CVE-2025-55182"
        severity = "critical"

    strings:
        $sliver1 = "sliver" ascii nocase
        $sliver2 = "SLIVER_CONFIG" ascii
        $miner1 = "xmrig" ascii nocase
        $miner2 = "stratum+tcp" ascii
        $backdoor1 = "reverse_shell" ascii
        $backdoor2 = "bind_shell" ascii
        $rsc_marker = "__rsc" ascii

    condition:
        $rsc_marker and
        (any of ($sliver*) or any of ($miner*) or any of ($backdoor*))
}

:material-file-download: prevention/yara.yar

# CVE-2025-55182 - Nginx Prevention Rules
# React2Shell Mitigation Configuration

# Block suspicious RSC payloads
map $request_body $block_rsc_exploit {
    default 0;
    "~*__rsc_type.*function_reference" 1;
    "~*__rsc_closure.*eval" 1;
    "~*__proto__.*constructor" 1;
    "~*prototype.*pollution" 1;
}

# Block suspicious headers
map $http_next_action $block_next_action {
    default 0;
    "~*[A-Za-z0-9+/=]{100,}" 1;  # Unusually long base64 action IDs
}

server {
    listen 80;
    server_name _;

    # Rate limiting for RSC endpoints
    limit_req_zone $binary_remote_addr zone=rsc_limit:10m rate=10r/s;

    location / {
        # Block exploit attempts
        if ($block_rsc_exploit) {
            return 403;
        }

        if ($block_next_action) {
            return 403;
        }

        # Apply rate limiting to RSC requests
        if ($http_rsc = "1") {
            limit_req zone=rsc_limit burst=20 nodelay;
        }

        # Limit request body size
        client_max_body_size 1m;

        # Block requests with suspicious content types
        if ($content_type ~* "text/x-component") {
            # Additional validation for RSC requests
            set $rsc_request 1;
        }

        # Proxy to application
        proxy_pass http://app:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Security headers
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "DENY" always;
        add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
    }

    # Block direct access to RSC internals
    location ~ /(_next/static|__nextjs) {
        # Validate referrer
        valid_referers none blocked server_names;
        if ($invalid_referer) {
            return 403;
        }

        proxy_pass http://app:3000;
    }

    # Logging for security monitoring
    access_log /var/log/nginx/rsc_access.log combined if=$rsc_request;
    error_log /var/log/nginx/rsc_error.log warn;
}

:material-file-download: prevention/nginx.conf

# CVE-2025-55182 - Apache HTTPD ModSecurity Rules
# React2Shell Mitigation Configuration

# Enable ModSecurity
LoadModule security2_module modules/mod_security2.so

<IfModule mod_security2.c>
    SecRuleEngine On
    SecRequestBodyAccess On
    SecResponseBodyAccess Off
    SecRequestBodyLimit 1048576
    SecRequestBodyNoFilesLimit 131072

    # CVE-2025-55182: Block RSC exploit payloads
    SecRule REQUEST_BODY "@rx __rsc_type.*function_reference" \
        "id:2025551801,\
        phase:2,\
        deny,\
        status:403,\
        log,\
        msg:'CVE-2025-55182 React2Shell Exploit Attempt - Malicious RSC Type',\
        tag:'CVE-2025-55182',\
        severity:'CRITICAL'"

    # Block prototype pollution in RSC
    SecRule REQUEST_BODY "@rx __proto__.*constructor" \
        "id:2025551802,\
        phase:2,\
        deny,\
        status:403,\
        log,\
        msg:'CVE-2025-55182 React2Shell - Prototype Pollution',\
        tag:'CVE-2025-55182',\
        severity:'CRITICAL'"

    # Block eval injection in RSC closure
    SecRule REQUEST_BODY "@rx __rsc_closure.*eval" \
        "id:2025551803,\
        phase:2,\
        deny,\
        status:403,\
        log,\
        msg:'CVE-2025-55182 React2Shell - Eval Injection',\
        tag:'CVE-2025-55182',\
        severity:'CRITICAL'"

    # Block suspicious RSC content type with malicious body
    SecRule REQUEST_HEADERS:Content-Type "@streq text/x-component" \
        "id:2025551804,\
        phase:1,\
        pass,\
        setvar:tx.rsc_request=1,\
        nolog"

    SecRule TX:rsc_request "@eq 1" \
        "id:2025551805,\
        chain,\
        phase:2,\
        deny,\
        status:403,\
        log,\
        msg:'CVE-2025-55182 React2Shell - Malicious RSC Request',\
        tag:'CVE-2025-55182',\
        severity:'CRITICAL'"
        SecRule REQUEST_BODY "@rx (Function\s*\(|setTimeout|setInterval|require\s*\()"

    # Block oversized Next-Action headers (potential payload)
    SecRule REQUEST_HEADERS:Next-Action "@gt 64" \
        "id:2025551806,\
        phase:1,\
        deny,\
        status:403,\
        log,\
        msg:'CVE-2025-55182 React2Shell - Suspicious Next-Action Header',\
        tag:'CVE-2025-55182',\
        severity:'HIGH'"

    # Rate limit RSC endpoints
    SecRule REQUEST_HEADERS:RSC "@streq 1" \
        "id:2025551807,\
        phase:1,\
        pass,\
        setvar:ip.rsc_counter=+1,\
        expirevar:ip.rsc_counter=60,\
        nolog"

    SecRule IP:rsc_counter "@gt 100" \
        "id:2025551808,\
        phase:1,\
        deny,\
        status:429,\
        log,\
        msg:'CVE-2025-55182 Rate Limit Exceeded for RSC Requests',\
        tag:'CVE-2025-55182',\
        severity:'WARNING'"

    # Log all RSC requests for monitoring
    SecRule REQUEST_HEADERS:RSC "@streq 1" \
        "id:2025551809,\
        phase:1,\
        pass,\
        log,\
        msg:'RSC Request Logged',\
        tag:'monitoring'"

</IfModule>

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2025-55182?

CVE-2025-55182 is a Critical (10.0) vulnerability: React Server Components Remote Code Execution (React2Shell). This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-12-05), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

How do I detect CVE-2025-55182?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2025-55182?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Is CVE-2025-55182 actively exploited?

Yes. CVE-2025-55182 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2025-12-05, which means it has been exploited in the wild. CISA also links it to known ransomware campaigns. CISA set a federal remediation deadline of 2025-12-12. Prioritise patching and deploy the detection and prevention rules above.

---

For authorized security testing and research only. See the full source and NVD record.