Outbreak Alert: React and Next.js unauthenticated RCE (React2Shell)

[ssrushti]

FortiRecon Digital Risk Protection (DRP), a SaaS-based service, includes External Attack Surface Management, Brand Protection, and Adversary Centric Intelligence. Adversary Centric Intelligence (ACI): leverages FortiGuard Threat Analysis to provide comprehensive coverage of dark web, open-source, and technical threat intelligence, including threat actor insights to enable organizations to respond proactively assess risks, respond faster to incidents, better understand their attackers, and guard assets. The Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides a realistic view of the impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc.
CVE ID	CVE-2025-66478
CVE Title	-
NVD Severity	Not Assigned
FortiRecon Severity	LOW
FortiRecon Score	30/100
Epss Score	0
Exploited	No
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	No
Available working exploit(s)	0
Available POC exploit(s)	39
Available POC exploit(s)	https://github.com/assetnote/react2shell-scanner https://github.com/Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478 https://github.com/emredavut/CVE-2025-55182 https://github.com/vercel-labs/fix-react2shell-next https://github.com/pyroxenites/Nextjs_RCE_Exploit_Tool
Darknet Mention(s)	0
Telegram Mention(s)	2 (Proxy Bar, We Leak Database)
FortiRecon Intelligence Reporting(s)	2 (OSINT)

CVE ID	CVE-2025-55182
CVE Title	Meta React Server Components Remote Code Execution Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	95/100
Epss Score	0.27807
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	169
Available POC exploit(s)	https://github.com/assetnote/react2shell-scanner https://github.com/ejpir/CVE-2025-55182-research https://github.com/msanft/CVE-2025-55182 https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc https://github.com/mrknow001/RSC_Detector
Darknet Mention(s)	0
Telegram Mention(s)	4 (Джокер ДНР, Proxy Bar, Ralf Hacker Channel, We Leak Database)
FortiRecon Intelligence Reporting(s)	1 (FortiGuard Research), 6 (OSINT)
Vendor Advisory:	https://www.facebook.com/security/advisories/cve-2025-55182 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182 https://news.ycombinator.com/item?id=46136026 https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vu... http://www.openwall.com/lists/oss-security/2025/12/03/4