On December 3, 2025, a critical security vulnerability that shook the global frontend ecosystem was disclosed. This vulnerability (CVE-2025-9281), dubbed ‘React2Shell’, is a Remote Code Execution (RCE) issue occurring during the serialization process of React Server Components (RSC).

As a security consultant, I analyze the technical causes of this currently spreading vulnerability and urgent countermeasures. It is understood that more than 165,000 servers are currently exposed to this attack.

1. Vulnerability Overview (Severity: Critical 10/10)

This vulnerability occurs when a hacker sends a specially crafted JSON payload to a React server. During the process where RSC handles client requests, unverified input values are passed to an internal eval()-like function on the server, allowing arbitrary system commands to be executed.

1.1 Affected Versions

• react-server-dom-webpack: Versions 19.0.0 to less than 19.2.0
• next: Versions 15.0.0 to less than 16.0.1 (When RSC is enabled)

1.2 Attack Scenario

1. The attacker scans the endpoints of a public React app.
2. Injects serialized data containing malicious code into the __rsc_action_id parameter.
3. The moment the server deserializes it, the shell script planted by the attacker is executed.
4. The attacker steals server environment variables (DB connection info, API keys) or makes the server part of a botnet.

2. Technical Deep Dive

The core of the problem lay in the implementation of the ‘Flight’ protocol, which is how React serializes data between server components and client components.

// Example of vulnerable code (simplified)
function resolveModel(id, model) {
  // Passing user input to function execution context without proper validation
  if (model && model.$$typeof === REACT_ELEMENT_TYPE) {
     // ...
     if (typeof model.type === 'string' && isMalicious(model.type)) {
        // RCE occurs here
        execute(model.props);
     }
  }
}

The attacker disguises an object that executes system commands into model.type. The React team did not anticipate this type of attack vector during the initial design, but AI-powered fuzzing tools found this gap.

3. Damage Status and Spread

As of December 10, according to a report by the Google Threat Intelligence team, approximately 640,000 domains worldwide are potential targets.

• South Korea: About 12,000 servers exposed in a vulnerable state.
• Major Targets: Fintech startups, e-commerce platforms, SaaS companies handling personal information.

Automated attack tools for ‘React2Shell’ are already being traded on the dark web for around $500, and cases of ransomware groups using them to encrypt servers and demand Bitcoin are being reported.

4. Urgent Response Guide

You must take the following actions immediately. There is no “later”.

4.1 Apply Patch (Top Priority)

The surest way is to update the libraries to the latest versions. The React team and Vercel deployed a hotfix within 48 hours of the vulnerability discovery.

# npm users
npm audit fix --force
npm install next@latest react@latest react-dom@latest

# yarn users
yarn upgrade next react react-dom

4.2 Update WAF (Web Application Firewall) Rules

For legacy systems where immediate patching is difficult, you must block attack patterns at the WAF level.

• Blocking Rules: Block patterns containing strings like __rsc and process.env or /bin/sh in HTTP request headers or bodies using regular expressions.
• Cloudflare/AWS WAF: Signatures to block ‘React2Shell’ have already been added to Managed Rules. Check if you have WAF enabled.

4.3 Server Log Monitoring

The possibility that infiltration has already occurred cannot be ruled out. Check the server’s outbound traffic logs.

• Check for attempts to connect to unfamiliar IPs (especially Eastern Europe or third countries) that the server does not usually communicate with.
• Check for sudden spikes in CPU usage (possibility of cryptojacking).

5. Fundamental Security Measure: Zero Trust

This incident shows how dangerous the complacent thought of “the framework will take care of it” is.

1. Input Validation: Regardless of what the framework does, all input values must be thoroughly verified (using Zod, Yup, etc.) at the business logic level.
2. Principle of Least Privilege: Web server processes should not run with root privileges. Even if an attacker succeeds in RCE, damage can be minimized inside a container with limited privileges.
3. Dependency Scanning: Integrate security scanning tools like Snyk or Trivy into the CI/CD pipeline to detect vulnerable packages before deployment.

6. Conclusion

React Server Components are a great technology, but as the boundary between server and client blurs, it has opened up a new Attack Surface.

Security is not about speed, but direction. Check your package.json right now and press the update button. I hope you don’t become the 165,000th victim.