React2Shell and related RSC vulnerabilities threat brief- early exploitation activity and threat actor techniques

Early Exploitation of Critical React2Shell Flaw Draws Immediate Threat Actor Attention

Within hours of the December 3, 2025 disclosure of CVE-2025-55182 — the maximum-severity Remote Code Execution (RCE) vulnerability in React Server Components (RSC) dubbed "React2Shell" — Cloudforce One observed active scanning and exploitation attempts in the wild, including traffic tied to infrastructure associated with Asian-nexus threat groups.

The React2Shell vulnerability stems from an unsafe deserialization flaw in the RSC Flight protocol's data-handling logic. When a server processes attacker-controlled payloads without proper validation, crafted input can inject logic that the server interprets in a privileged context. A single unauthenticated HTTP request is sufficient for exploitation; no user interaction or elevated permissions are required. Successful exploitation enables arbitrary, privileged JavaScript execution on the affected server.

Also disclosed alongside React2Shell were two additional vulnerabilities affecting specific RSC implementations: CVE-2025-55183 and CVE-2025-55184. Both relate to RSC payload handling and Server Function semantics, though they are distinct from React2Shell.

Threat Actor Tooling and Tactics

Cloudforce One's analysis of the early exploitation wave revealed that threat actors relied heavily on publicly available and commercial tools to identify vulnerable servers:

• Vulnerability intelligence: Aggregation of CVEs, advisories, and exploits for tracking and prioritization.
• Vulnerability reconnaissance: Use of large-scale Internet-wide scanning and asset discovery platforms, plus software stack fingerprinting tools, to find exposed systems running React applications or RSC components.
• Vulnerability scanning: Observed use of Nuclei (with User-Agent Nuclei - CVE-2025-55182) and a dedicated scanner presenting the User-Agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 React2ShellScanner/1.0.0".
• Vulnerability exploitation: Use of Burp Suite for identifying and exploiting vulnerabilities in HTTP/S traffic.

Reconnaissance and Targeting Patterns

Internet-wide asset discovery. The actors leveraged an Internet-wide scanning and asset-discovery platform to enumerate potential targets, querying for React-specific icon hashes, framework-associated metadata, and page titles containing React-related keywords. This approach was designed to rapidly build an inventory of exploitable hosts running React and Next.js applications before initiating direct probing.

Filtering and enumeration. Operators applied additional filtering logic during reconnaissance to refine their target set and minimize noise. Notably, they excluded Chinese IP space from their searches, suggesting an intentional effort to avoid collecting data on potentially domestic infrastructure. They also constrained scanning to specific geographic regions and national networks to identify likely high-value hosts, and leveraged SSL certificate attributes — including issuer details, subject fields, and top-level domains — to surface government or critical-infrastructure systems using .gov or other restricted TLDs.

Target analysis. The highest-density probing occurred against networks in Taiwan, Xinjiang Uygur, Vietnam, Japan, and New Zealand — regions frequently associated with geopolitical intelligence collection priorities. Additional selective targeting was observed against government (.gov) websites, academic research institutions, and critical-infrastructure operators, including a national authority responsible for the import and export of uranium, rare metals, and nuclear fuel.

The actors also prioritized high-sensitivity technology targets such as enterprise password managers and secure-vault services, likely for downstream access to broader organizational credentials. Edge-facing SSL VPN appliances with administrative interfaces incorporating React-based components were also targeted, suggesting an effort to exploit React2Shell across both traditional web applications and embedded web management frameworks.

Actor attribution. Early scanning and exploitation attempts originated from IP addresses previously associated with multiple Asia-affiliated threat actor clusters. While not all observed IPs belong to a single operator, the simultaneous activity suggests shared tooling, infrastructure, or parallel experimentation among groups with common purposes and targeting objectives.

Exploitation Volume and Trends

Cloudflare's Managed Rulesets for React2Shell began detecting significant activity within hours of the disclosure. From 2025-12-03 00:00 UTC to 2025-12-11 17:00 UTC, Cloudflare received 582.10M hits — an average of 3.49M hits per hour, with a maximum of 12.72M hits in a single hour. The average unique IP count per hour was 3,598, with a maximum of 16,585 IPs in an hour.

Data shows distinct peaks above 6,387 unique User-Agents per hour, indicating a heterogeneous mix of tools and frameworks in use, with an average of 2,255 unique User-Agents per hour. Payload size analysis revealed a long-tailed distribution dominated by sub-kilobyte probes but punctuated by extremely large outliers, suggesting actors are testing a wide range of payload sizes and experimenting with variations.

Additional RSC Vulnerabilities

CVE-2025-55184: React Function Denial of Service

This vulnerability reveals that RSC frameworks can be forced into a Node.js state where the runtime unwraps an infinite recursion of nested Promises. The behavior freezes the server indefinitely, prevents yielding back to the event loop, and effectively takes the server offline. It does not require specific Server Action usage — merely the presence of a server capable of processing an RSC Server Action payload. The trigger condition is a cyclic promise reference inside the RSC payload.

CVE-2025-55183: Server Function Source Code Leak

This vulnerability reveals that certain RSC frameworks can leak server-only source code under specific conditions. If an attacker gains access to a Server Function that accepts an argument undergoing string coercion and does not validate that the argument is of an expected primitive type, the attacker can coerce that argument into a reference to a different Server Function. The coerced value's toString() output then causes the server to return the source code of the referenced Server Function.

Cloudflare Protection Measures

Cloudflare's protection strategy is multi-layered. React-based applications and frameworks deployed on Cloudflare Workers are inherently immune, as the Workers security model prevents exploits from succeeding at the runtime layer regardless of the malicious payload. Additionally, Cloudflare urgently deployed WAF rules to detect and block traffic proxied through its network related to React2Shell and the recently disclosed RSC vulnerabilities, with the default action set to Block. These protections are included in both the Cloudflare Free Managed Ruleset (available to all Free customers) and the standard Cloudflare Managed Ruleset (available to all paying customers).

The Cloudflare security team continues to monitor for additional attack variations and will update protections as necessary to maintain continuous security for all proxied traffic.

Patch and Monitor: Closing the React2Shell Window

Cloudflare's emergency response—raising WAF limits and deploying rules—has blunted the first wave of attacks. Yet CVE-2025-55182 is a durable threat, not a one-off event. The speed with which it was weaponized demands continuous vigilance, not a single round of mitigation.

Cloudflare is maintaining active surveillance for new exploit variants and refining its WAF rules to catch evasion attempts. However, network-layer controls cannot fix an unpatched application. Remediation must happen at the source: organizations need to patch all affected React and Next.js assets immediately. Layering platform-level WAF protection with prompt application patching is the only dependable defense against this vulnerability.

Indicators of Compromise