--- title: React2Shell Exploitation Escalates into Large-Scale... description: CISA has accelerated the patching deadline for React2Shell (CVE-2025-55182), a critical vulnerability with a CVSS score of 10.0 affecting React Server... canonical: https://daily.dev/posts/react2shell-exploitation-escalates-into-large-scale-global-attacks-forcing-emergency-mitigation-2fekecp9t twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation | daily.dev og:description: CISA has accelerated the patching deadline for React2Shell (CVE-2025-55182), a critical vulnerability with a CVSS score of 10.0 affecting React Server... og:url: https://daily.dev/posts/react2shell-exploitation-escalates-into-large-scale-global-attacks-forcing-emergency-mitigation-2fekecp9t og:image: https://api.daily.dev/og/posts/2FeKECP9T.png og:image:alt: React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation **[The Hacker News](https://daily.dev/sources/thn)** · 3 min read · 33 upvotes · 3 comments ## Summary CISA has accelerated the patching deadline for React2Shell (CVE-2025-55182), a critical vulnerability with a CVSS score of 10.0 affecting React Server Components and frameworks like Next.js. The flaw allows unauthenticated remote code execution through unsafe deserialization. Since disclosure on December 3, 2025, threat actors have conducted widespread exploitation with over 35,000 attempts recorded in a single day, targeting government sites, critical infrastructure, and technology companies. Over 137,000 vulnerable IP addresses remain exposed globally, with attackers deploying cryptocurrency miners, botnet malware, and conducting reconnaissance for supply chain attacks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@byteoutlaw** · 2 upvotes > I love it, this is what the internet was and apparently still is 🙃 😌 ☺️ **@abhiroop43** · 0 upvotes > Another react hack, surprise surprise **@jliter85** · 0 upvotes > This highlights how React and Next.js are now true server-side attack surfaces. Patching React alone isn’t enough the full framework stack and dependencies must be upgraded. WAF rules help temporarily, but fast updates and limiting exposed server components are what actually fix the risk. ## Similar posts on daily.dev - [React2Shell: Anatomy of a max-severity flaw that sent shockwaves through the web](https://daily.dev/posts/react2shell-anatomy-of-a-max-severity-flaw-that-sent-shockwaves-through-the-web-6dlrkicmf) · InfoWorld · 0 upvotes · 0 comments - [Attackers Use New Tool to Scan for React2Shell Exposure](https://daily.dev/posts/attackers-use-new-tool-to-scan-for-react2shell-exposure-qzj8577e3) · Dark Reading · 0 upvotes · 0 comments - [A security checklist for your React and Next.js apps](https://daily.dev/posts/a-security-checklist-for-your-react-and-next-js-apps-pevwqmgpr) · The New Stack · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#react](https://daily.dev/tags/react), [#kubernetes](https://daily.dev/tags/kubernetes), [#nextjs](https://daily.dev/tags/nextjs), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/react2shell-exploitation-escalates-into-large-scale-global-attacks-forcing-emergency-mitigation-2fekecp9t) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation","url":"https://daily.dev/posts/react2shell-exploitation-escalates-into-large-scale-global-attacks-forcing-emergency-mitigation-2fekecp9t","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/react2shell-exploitation-escalates-into-large-scale-global-attacks-forcing-emergency-mitigation-2fekecp9t"},"datePublished":"2025-12-12T08:58:48.102Z","dateModified":"2025-12-12T08:59:13.020Z","description":"CISA has accelerated the patching deadline for React2Shell (CVE-2025-55182), a critical vulnerability with a CVSS score of 10.0 affecting React Server...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/db6cde6eeec054130e80399af94418b2?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/db6cde6eeec054130e80399af94418b2?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"The Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/thn","url":"https://daily.dev/sources/thn"},"commentCount":3,"discussionUrl":"https://daily.dev/posts/react2shell-exploitation-escalates-into-large-scale-global-attacks-forcing-emergency-mitigation-2fekecp9t","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":33},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":3}],"keywords":"cyber,react,kubernetes,nextjs,vulnerability","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Hacker News","item":"https://daily.dev/sources/thn"},{"@type":"ListItem","position":3,"name":"React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/react2shell-exploitation-escalates-into-large-scale-global-attacks-forcing-emergency-mitigation-2fekecp9t","comment":[{"@type":"Comment","text":"I love it, this is what the internet was and apparently still is 🙃 😌 ☺️","datePublished":"2025-12-16T20:14:52.961Z","url":"https://daily.dev/posts/2FeKECP9T#c-HNrIDLHUn","author":{"@type":"Person","name":"Jacob B. Bonde","url":"https://daily.dev/byteoutlaw","image":"https://media.daily.dev/image/upload/s--veTChHK7--/f_auto/v1733220070/avatars/avatar_5cQvIZKr5tDFDotVDjulg"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"Another react hack, surprise surprise","datePublished":"2026-01-09T05:27:39.931Z","url":"https://daily.dev/posts/2FeKECP9T#c-0SqTmTnsr","author":{"@type":"Person","name":"Abhiroop Santra","url":"https://daily.dev/abhiroop43","image":"https://avatars.githubusercontent.com/u/5673129?v=4"}},{"@type":"Comment","text":"This highlights how React and Next.js are now true server-side attack surfaces. Patching React alone isn’t enough the full framework stack and dependencies must be upgraded. WAF rules help temporarily, but fast updates and limiting exposed server components are what actually fix the risk.","datePublished":"2025-12-28T18:58:57.086Z","url":"https://daily.dev/posts/2FeKECP9T#c-Iwkog0PmA","author":{"@type":"Person","name":"John Liter","url":"https://daily.dev/jliter85","image":"https://media.daily.dev/image/upload/s--DQ2HUrO4--/f_auto/v1785100315/avatars/avatar_yHf9cPdgTQEtokv6d8qhM?_a=BAMAMicg0"}}]} ```