{"id":8991,"date":"2025-12-06T10:03:47","date_gmt":"2025-12-06T10:03:47","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/12\/06\/2-15m-web-services-running-next-js-exposed-over-internet-active-exploitation-underway-patch-now\/"},"modified":"2025-12-06T10:03:47","modified_gmt":"2025-12-06T10:03:47","slug":"2-15m-web-services-running-next-js-exposed-over-internet-active-exploitation-underway-patch-now","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/12\/06\/2-15m-web-services-running-next-js-exposed-over-internet-active-exploitation-underway-patch-now\/","title":{"rendered":"2.15M Web Services Running Next.js Exposed Over Internet, Active Exploitation Underway \u2013 Patch Now"},"content":{"rendered":"

2.15M Web Services Running Next.js Exposed Over Internet, Active Exploitation Underway \u2013 Patch Now
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A critical unauthenticated remote code execution vulnerability dubbed \u201cReact2Shell<\/a>\u201d is actively being exploited in the wild, putting millions of web services at risk.<\/p>\n

On December 3, React disclosed CVE-2025-55182<\/a>, a critical flaw in React Server Components with a CVSS score of 10.<\/p>\n

The vulnerability stems from insecure deserialization within the \u201cFlight\u201d protocol used by React Server Components.<\/p>\n

Attackers can execute arbitrary code on vulnerable servers by sending specially crafted HTTP requests to Server Function endpoints without requiring authentication. This allows threat actors to gain complete control of affected systems.<\/p>\n

Active Exploitation by State-Sponsored Groups<\/strong><\/h2>\n

Amazon Web Services researchers reported that China-nexus threat actors<\/a>, including Earth Lamia and Jackpot Panda, began exploiting this vulnerability within 24 hours of its public disclosure.<\/p>\n

The attackers are targeting vulnerable cloud-hosted applications using React Server Components. Often, they deploy web shells and backdoors shortly after gaining initial access.<\/p>\n

\n\n\n\n\n\n\n\n\n
Field<\/strong><\/th>\nDetails<\/strong><\/th>\n<\/tr>\n<\/thead>\n
CVE-ID<\/strong><\/td>\nCVE-2025-55182<\/td>\n<\/tr>\n
CVSS Score<\/strong><\/td>\n10.0 (Critical)<\/td>\n<\/tr>\n
Vulnerability Type<\/strong><\/td>\nUnauthenticated Remote Code Execution<\/td>\n<\/tr>\n
Affected Versions<\/strong><\/td>\nReact 19.0.0, 19.1.0, 19.1.1, 19.2.0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

As of December 5, CISA added CVE-2025-55182<\/a> to its Known Exploited Vulnerabilities Catalog, underscoring the severity and active exploitation of this flaw.<\/p>\n

GreyNoise has also documented opportunistic exploitation attempts against their honeypots, indicating widespread scanning and exploitation activity across the internet.<\/p>\n

According to Censys<\/a>, approximately 2.15 million internet-facing web services may be affected by this vulnerability.<\/p>\n

These include exposed services running React Server Components and affected frameworks such as Next.js, Waku, React Router, and RedwoodSDK.<\/p>\n

While this count reflects software exposure rather than confirmed vulnerable versions, the scale of potential impact is significant given the popularity of these frameworks.<\/p>\n

The vulnerability affects React Server Components packages, including react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, in versions 19.0.0 through 19.2.0.<\/p>\n

Multiple popular frameworks depend on these packages, including Next.js versions 14.3.0-canary.77 and above when using App Router, React Router RSC preview, Waku, Vite RSC Plugin, Parcel RSC Plugin, and RedwoodSDK.<\/p>\n

Pure client-side React applications that do not run server-side components are not affected.<\/p>\n

However, applications implementing React Server<\/a> Components remain vulnerable even if they do not explicitly use Server Function endpoints.<\/p>\n

Fixed versions are now available. Organizations should immediately update to React 19.0.1, 19.1.2, or 19.2.1.<\/p>\n

Next.js users should upgrade to versions 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, or 16.0.7 depending on their current version.<\/p>\n

While WAF providers, including Cloudflare and AWS, have deployed protective rule sets, some proof-of-concept<\/a> exploits demonstrate bypass techniques. Patching remains the most reliable mitigation strategy.<\/p>\n

Given the active exploitation, maximum severity score, and widespread framework adoption, organizations running React Server Components should treat this as an emergency patch priority.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post 2.15M Web Services Running Next.js Exposed Over Internet, Active Exploitation Underway \u2013 Patch Now<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Abinaya
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

2.15M Web Services Running Next.js Exposed Over Internet, Active Exploitation Underway \u2013 Patch Now A critical unauthenticated remote code execution vulnerability dubbed \u201cReact2Shell\u201d is actively being exploited in the wild, putting millions of web services at risk. On December 3, React disclosed CVE-2025-55182, a critical flaw in React Server Components with a CVSS score of […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,648],"tags":[130],"class_list":["post-8991","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8991"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=8991"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8991\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=8991"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=8991"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=8991"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}