React2Shell (CVE-2025-55182)
Two critical vulnerabilities have been identified affecting React Server Components (CVE-2025-55182) and Next.js (CVE-2025-66478). The vulnerabilities affect default configurations of affected applications, leaving standard deployments immediately exposed and significantly widening potential impact.
Security researcher Lachlan Davidson reported the vulnerability to Meta on November 29th, 2025. React and Next.js released patched versions on December 3rd.
Attackers are now actively bypassing WAF mitigations deployed by major vendors by prepending junk data to push payloads past inspection limits.
Most exploitation attempts we're currently observing abuse WAF inspection limits. Attackers prepend junk data to push malicious payloads past the first few KB that WAFs inspect. Our current recommendation is to block requests with the Next-Action header that exceed your WAF's inspection limit—this ensures oversized requests are blocked entirely.
We'll update this page with new bypass techniques and mitigations as the situation evolves.
⚠️ The real fix is patching
Update React to 19.0.1+, 19.1.2+, or 19.2.1+ and Next.js to patched versions.
WAF rules provide defense-in-depth while you patch, but are not a substitute for updating your dependencies and deploying runtime mitigations.
More info about runtime mitigations can be found here.
Cloudflare Managed + Custom
(http.request.method eq "POST") and
(any(http.request.headers.names[*] matches "(?i)(?:next-action|rsc-action-id)")) and
(
(http.request.body.size gt 8192) or
(
(http.request.body.raw matches "(?i)status\"\\s*:\\s*\"resolved_model\"") and
(http.request.body.raw matches "(?i):constructor") and
(http.request.body.raw matches "(?i)_response\"\\s*:") and
(http.request.body.raw matches "(?i)_formData\"\\s*:")
)
)
(http.request.method eq "POST") and
(any(http.request.headers.names[*] matches "(?i)(?:next-action|rsc-action-id)")) and
(
(http.request.body.size gt 131072) or
(
(http.request.body.raw matches "(?i)status\"\\s*:\\s*\"resolved_model\"") and
(http.request.body.raw matches "(?i):constructor") and
(http.request.body.raw matches "(?i)_response\"\\s*:") and
(http.request.body.raw matches "(?i)_formData\"\\s*:")
)
)
AWS WAF Managed + Custom
AWSManagedRulesKnownBadInputsRuleSet is updated to v1.24+.
"OversizeHandling": "MATCH" to catch bypasses:
{
"Action": {
"Block": {}
},
"Name": "react2shell",
"Priority": 26,
"Statement": {
"AndStatement": {
"Statements": [
{
"RegexMatchStatement": {
"FieldToMatch": {
"Method": {}
},
"RegexString": "POST",
"TextTransformations": [
{
"Priority": 0,
"Type": "NONE"
}
]
}
},
{
"RegexMatchStatement": {
"FieldToMatch": {
"Body": {
"OversizeHandling": "MATCH"
}
},
"RegexString": "(?i)\"status\"\\s*:\\s*\"resolved_model\"|:constructor|_response\"\\s*:|_formData\"\\s*:",
"TextTransformations": [
{
"Priority": 0,
"Type": "URL_DECODE_UNI"
},
{
"Priority": 1,
"Type": "JS_DECODE"
},
{
"Priority": 2,
"Type": "UTF8_TO_UNICODE"
}
]
}
},
{
"RegexMatchStatement": {
"FieldToMatch": {
"Headers": {
"MatchPattern": {
"All": {}
},
"MatchScope": "KEY",
"OversizeHandling": "MATCH"
}
},
"RegexString": "(?i)(?:next-action|rsc-action-id)",
"TextTransformations": [
{
"Priority": 0,
"Type": "NONE"
}
]
}
}
]
}
},
"VisibilityConfig": {
"CloudWatchMetricsEnabled": true,
"MetricName": "react2shell",
"SampledRequestsEnabled": true
}
}
Akamai Custom Rule
{
"name": "react2shell",
"description": "Block React Server Components exploitation attempts",
"conditions": {
"all": [
{
"type": "requestMethodMatch",
"positiveMatch": true,
"values": ["POST"]
},
{
"type": "requestHeaderMatch",
"positiveMatch": true,
"headerName": "*",
"matchOperator": "MATCHES_REGEX",
"matchValue": "(?i)(?:next-action|rsc-action-id)",
"matchCaseSensitive": false
},
{
"any": [
{
"type": "contentLengthMatch",
"positiveMatch": true,
"matchOperator": "GREATER_THAN",
"matchValue": 16384
},
{
"all": [
{
"type": "requestBodyMatch",
"positiveMatch": true,
"matchOperator": "MATCHES_REGEX",
"matchValue": "(?i)status\"\\s*:\\s*\"resolved_model\"",
"matchCaseSensitive": false
},
{
"type": "requestBodyMatch",
"positiveMatch": true,
"matchOperator": "MATCHES_REGEX",
"matchValue": "(?i):constructor",
"matchCaseSensitive": false
},
{
"type": "requestBodyMatch",
"positiveMatch": true,
"matchOperator": "MATCHES_REGEX",
"matchValue": "(?i)_response\"\\s*:",
"matchCaseSensitive": false
},
{
"type": "requestBodyMatch",
"positiveMatch": true,
"matchOperator": "MATCHES_REGEX",
"matchValue": "(?i)_formData\"\\s*:",
"matchCaseSensitive": false
}
]
}
]
}
]
},
"action": "DENY"
}
YARA Rules
Community-contributed YARA rules to detect exploitation attempts, webshell indicators, and PoC payloads related to CVE-2025-55182 and CVE-2025-66478. by Florian Roth
react_pocs_indicators_dec25.yar Neo23x0/signature-base on GitHubReports and analysis of active exploitation attempts observed in the wild.