Briefing
A critical vulnerability, designated CVE-2025-55182 and dubbed “React2Shell,” has been identified and is under active exploitation by state-nexus threat actors, posing a direct, maximum-severity risk to the Web3 front-end attack surface. The flaw resides in the deserialization logic of React Server Components, allowing an unauthenticated attacker to achieve Remote Code Execution (RCE) on vulnerable application servers. This RCE capability enables threat actors to inject malicious wallet-draining code or manipulate transaction parameters on any decentralized application (dApp) utilizing the affected React or Next.js versions. The vulnerability carries a maximum CVSS score of 10.0, indicating the highest possible severity and ease of exploitation.
Context
The digital asset security landscape has historically focused on smart contract audits, often overlooking the traditional web infrastructure layer where user interaction occurs. This creates a systemic blind spot, as front-end compromises → such as DNS hijacking or malicious script injection → have been a persistent and effective vector for draining user funds, circumventing even formally verified on-chain logic. The reliance of most modern dApps on common web frameworks like React and Next.js establishes a massive, centralized supply chain risk, making a single library flaw a potential global contagion event for the ecosystem.
Analysis
The attack exploits an unsafe deserialization flaw within the React Server Components logic, specifically targeting how the server processes and reconstructs data from the client in HTTP POST requests. An attacker sends a specially crafted request containing malicious code embedded within the next-action or rsc-action-id headers. The vulnerable server component attempts to deserialize this input, which incorrectly executes the attacker’s payload, resulting in unauthenticated Remote Code Execution on the hosting server. This grants the threat actor full control over the application’s front-end code, enabling them to silently modify the dApp interface to redirect user transactions or steal private keys.
Parameters
- CVSS Score → 10.0 (Maximum severity rating for the vulnerability)
- Vulnerability Type → Unsafe Deserialization leading to Remote Code Execution
- Affected Components → React 19.x and Next.js 15.x/16.x using App Router
- Threat Actor Attribution → Multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda
Outlook
Immediate mitigation requires all dApp operators and Web3 front-end developers running affected versions of React or Next.js to apply the latest security patches without delay. Failure to patch constitutes a maximum-severity operational risk that is already being actively exploited in the wild. The primary second-order effect is a massive contagion risk across the DeFi ecosystem, as this flaw affects the foundational layer of web infrastructure, not a single protocol. This incident necessitates a new security best practice → implementing robust Web Application Firewall (WAF) rules to block suspicious HTTP headers ( next-action , rsc-action-id ) and adopting a zero-trust model for all data deserialization from external sources.
