China-Nexus Hackers Actively Exploiting React2Shell Vulnerability in The Wild

China-nexus threat groups are racing to weaponize the new React2Shell bug, tracked as CVE-2025-55182, only hours after its public disclosure.

The flaw sits in React Server Components and lets an attacker run code on the server without logging in. Early scans show broad probing of internet-facing React and Next[.]js apps, with a focus on high-value cloud workloads.

The bug hits React 19.x and Next[.]js 15.x and 16.x when the App Router feature is in use. Even apps that do not call server actions are at risk as long as they support React Server Components.

This makes the exposure large for teams that have adopted the latest React stack but have not yet patched.

AWS security analysts and researchers identified live React2Shell exploit traffic in their MadPot honeypot network within hours of the advisory going public.

They then pushed new defenses through Sonaris and updated AWS WAF managed rules, while warning that these layers do not replace fast patching on customer-run EC2, containers, and on-prem hosts.

Traffic linked to China-nexus groups such as Earth Lamia and Jackpot Panda shows active testing of public proof-of-concept code against real apps.

Some clusters spend close to an hour fine-tuning payloads, trying commands like whoami, id, file writes to /tmp/'pwned'.txt, and reads of /etc/'passwd'.

Infection flow and exploit chain

This section gives a complete technical breakdown in clear, simple terms. A typical React2Shell attack starts with a crafted POST request to a React Server Components endpoint.

The body holds a fake “action” payload that abuses the unsafe deserialize step to inject JavaScript on the server.

A simple example looks like this:-

'POST /_rsc HTTP/1[.]1'
Host: victim[.]example
Content-Type: application/json

{"next-action":"'$@'malicious_payload","status":"resolved_model"}

Once the payload lands, the server may spawn shell commands, touch files in / 'tmp‘, or open new outbound connections from the Node process.

Many public exploits are broken, but attackers still fire them at scale, filling logs with noise and hiding working chains.

Teams should hunt for these headers and patterns, plus odd child processes from Node[.]js; this highlights these signs for fast review by incident responders.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.