{"id":4286,"date":"2025-12-09T05:44:11","date_gmt":"2025-12-09T05:44:11","guid":{"rendered":"https:\/\/certera.com\/blog\/?p=4286"},"modified":"2025-12-09T05:44:12","modified_gmt":"2025-12-09T05:44:12","slug":"cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk","status":"publish","type":"post","link":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/","title":{"rendered":"CVE-2025-55182: New React2Shell Vulnerability Puts Millions of Sites at Risk"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"h-a-scenario\">A Scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">One day, you woke up to find your site being controlled by a hacker, and it was all due to a secret breach in your code. That is precisely what is horrifying about the React2Shell (CVE-2025-55182). <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">React2Shell (CVE-2025-55182) new bug in a widely popular web framework, React (but it applies to any software that can be sent to your own server by an attacker), that allows the attacker to just execute any code on your server without necessarily having to log in. Simply put, it is equivalent to leaving a backdoor on your site.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">All companies that use React (or Next.js or other frameworks) should be aware of this critical vulnerability as soon as possible.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-why-react2shell-is-serious\">Why React2Shell is Serious?<\/h2>\n\n\n\n<p class=\"quote-section wp-block-paragraph\">Security experts have given it a <strong>CVSS score of 10.0 (Critical).<\/strong> In other words, it has the maximum \u201cdanger\u201d rating for cyber flaws. If your site uses React\u2019s server components (the behind-the-scenes code that powers interactive features), this bug could let a stranger slip malicious commands into your server. <\/p>\n\n\n\n<p class=\"quote-section wp-block-paragraph\">As one security bulletin bluntly states, \u201cIf your app supports <strong>React Server Components<\/strong>, you are likely vulnerable out of the box\u2026 <strong>Patch immediately<\/strong>\u201d.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-what-is-react2shell-cve-2025-55182\">What Is React2Shell (CVE-2025-55182)?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">React2Shell is a weakness in React Server Components \u2013 the part of React that runs on your web server (not in the user\u2019s browser). Normally, React safely handles data sent between the site and the server. But React2Shell is a flaw in that process. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In technical terms, it\u2019s an \u201c<strong>unsafe deserialization<\/strong>\u201d vulnerability, which simply means the server is trusting input it shouldn\u2019t. A hacker can craft a special data packet and send it to your server as if it were a normal request. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">React accidentally treats that malicious packet like a real command and executes it. The result? With Remote Code Execution (RCE), the attacker can run any code they want on your server, like a ghost writer taking over your computer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">React\u2019s own developers and security researchers discovered this flaw in late November 2025 and promptly disclosed it. The official React team confirmed that even apps with default settings could be at risk. In fact, they urged everyone: <strong>\u201c<a href=\"https:\/\/react.dev\/blog\/2025\/12\/03\/critical-security-vulnerability-in-react-server-components\">We recommend upgrading immediately<\/a>\u201d<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-why-you-should-care-a-10-0-critical-alert\">Why You Should Care: A 10.0 Critical Alert<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This isn\u2019t just theory; real hackers are already exploiting React2Shell. Within hours of public disclosure, <strong>Amazon\u2019s security team observed<\/strong> multiple China-linked hacker groups (like Earth Lamia and Jackpot Panda) scanning for and trying to use React2Shell in the wild. These groups are notorious. They often hit organisations around the globe right after a new exploit is revealed. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>AWS even noted that while<\/strong> they have web filters and firewalls catching some attempts, those measures are no substitute for patching the code. As AWS bluntly puts it, if you run React or Next.js on your own servers or cloud containers, \u201cyou must update vulnerable applications immediately\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The server of your website is a vault. React2Shell is another form of lockpick that thieves have learned. A burglar may dance in with that key. Practically, a hacker might steal your valuable data, defame your site, install malware, or even begin to mine cryptocurrency on your computer. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Security researchers have already evidenced this. Crypto-miners were mined on some of the compromised Cloud servers. All this could not have been imagined were the vulnerability had been first patched.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-react2shell-puts-your-company-in-direct-danger\">React2Shell puts your Company in Direct Danger<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Any organisation that relies on the compromised versions of React or Next.js may experience a breach, downtime, or even more. As proof-of-concept exploits are now publicly available, and automated scanners are available, the clock is so much better. The industry is being urged by experts to consider the same as an emergency for all companies.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-react2shell-attacks-work\">How React2Shell Attacks Work?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The technical root cause of React2Shell is \u201cunsafe deserialization\u201d. <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>When users interact with a web page (e.g., clicking a button), the browser and server exchange data.<\/li>\n\n\n\n<li>React Server Components use the Flight protocol to process this data between client and server.<\/li>\n\n\n\n<li>Normally, the server validates incoming requests to ensure they are safe.<\/li>\n\n\n\n<li>In React2Shell, this validation is broken or bypassed.<\/li>\n\n\n\n<li>Effectively, an attacker can send data that tells the server, &#8220;execute this code&#8221;, and the server does it without proper checks.<\/li>\n\n\n\n<li>This means <a href=\"https:\/\/certera.com\/blog\/what-is-malware-how-to-prevent-malware-attacks\/\">malicious commands<\/a> can be embedded directly inside the data payload.<\/li>\n\n\n\n<li>No authentication or login is required. The attacker just needs access to the server endpoints.<\/li>\n\n\n\n<li>Attackers can automate thousands of malicious requests quickly using scripts.<\/li>\n\n\n\n<li>Because the vulnerability exists in default configurations, even new or uncustomized websites are exposed.<\/li>\n<\/ul>\n\n\n\n<p class=\"quote-section wp-block-paragraph\"><strong>The key point is that attacks require no login or special access. <\/strong>It only needs a way to reach your site\u2019s server endpoints. A hacker\u2019s script can automate thousands of these fake \u201corders\u201d in minutes. Because the vulnerability is in default settings, even new sites without custom server code can be hit.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-who-is-vulnerable-popular-frameworks-and-sites\">Who Is Vulnerable? Popular Frameworks and Sites<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you use modern JavaScript stacks, pay attention: chances are high you\u2019re affected. The flaw exists in <strong>React 19.x server packages<\/strong> (like <strong>react-server-dom-webpack and others<\/strong>) and any frameworks that bundle those.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That includes nearly <strong>all recent versions of Next.js (15.x and 16.x) <\/strong>when using the new App Router, as well as projects using <strong>frameworks like React Router, Expo, Redwood, Waku, Vite, Parcel and more.<\/strong> In short, if your website\u2019s frontend is built with React and uses server-side rendering or React Server Components, you need to act.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Importantly, even if you haven\u2019t written any custom server-side code yourself, your site can still be vulnerable. The React team and security firms point out that the vulnerability exists as long as React Server Components are enabled, even if your app never calls them directly. So a default Next.js or React setup is often already at risk.<\/p>\n\n\n\n<p class=\"quote-section wp-block-paragraph\">Security scans by firms like <strong><a href=\"https:\/\/www.wiz.io\/blog\/critical-vulnerability-in-react-cve-2025-55182\">Wiz<\/a><\/strong> show this is not a niche issue. They report that around <strong>39% of cloud environments<\/strong> have vulnerable React\/Next instances, <strong>and 44% of all cloud<\/strong> environments have public-facing Next.js apps. That means millions of websites and services are potentially exposed. Notable companies and startups use these technologies, so the impact could be massive.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Because of this widespread use, many large sites have already rushed to patch. <strong>For example<\/strong>, Google\u2019s Firebase service announced it applied workarounds, and other hosting providers are racing to help clients. But you can\u2019t rely solely on your hosting provider. You should confirm and patch at your end.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-take-action-now-and-protect-your-business\">Take Action Now and Protect Your Business<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There\u2019s no time to waste. Here are the concrete steps you should take immediately to protect your website and data:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Identify vulnerable components.<\/strong><\/li>\n\n\n\n<li><strong>Upgrade to patched versions.<\/strong> The React team released fixes for this bug. In practice, this means updating React to v19.0.1, 19.1.2, or 19.2.1 (or later). <\/li>\n\n\n\n<li><strong>For Next.js users<\/strong>, upgrade to the latest stable release in your version line (for example, Next.js 15.x should be at least 15.5.7 and 16.x at least 16.0.7). These updates neutralise the exploit. Be sure to follow any official migration guides if needed. If you\u2019re unsure how to update, ask your web developer or IT team to do this right away.<\/li>\n\n\n\n<li><strong><a href=\"https:\/\/certera.com\/services\/malware-scanning-removal\">Scan and monitor your sites<\/a>.<\/strong><\/li>\n\n\n\n<li><strong>Harden your defences.<\/strong><\/li>\n\n\n\n<li><strong><a href=\"https:\/\/certera.com\/services\">Use professional security services<\/a>.<\/strong><\/li>\n\n\n\n<li><strong>Stay informed and plan.<\/strong><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Don\u2019t let your website become the next headline. Act now to close this dangerous hole. Update your React and Next.js versions immediately, scan your site for vulnerabilities, and put in place ongoing security measures. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Your website is too important to gamble with security. Use best cybersecurity tools like <a href=\"https:\/\/certera.com\/sitelock\">SiteLock<\/a> <span style=\"box-sizing: border-box; margin: 0px; padding: 0px;\">to\u00a0detect<\/span> and patch vulnerabilities, you ensure your site and customers stay safe.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A Scenario One day, you woke up to find your site being controlled by a hacker, and it was all due to a secret breach in your code. That is precisely what is horrifying about the React2Shell (CVE-2025-55182). React2Shell (CVE-2025-55182) new bug in a widely popular web framework, React (but it applies to any software<span class=\"morelink d-block mt-3\"><a href=\"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/\">Read More<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":4297,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[32],"tags":[811,810,812],"class_list":["post-4286","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-vulnerability","tag-cve-2025-55182","tag-react2shell-attack","tag-react2shell-vulnerability","entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.9 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2025-55182: Every Business Using React Needs to Act Now<\/title>\n<meta name=\"description\" content=\"&quot;Your Website Might Already Be Hacked&quot; React2Shell Is the Log4Shell of 2025, What You Need to Know About React2Shell (CVE-2025-55182).\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2025-55182: Every Business Using React Needs to Act Now\" \/>\n<meta property=\"og:description\" content=\"&quot;Your Website Might Already Be Hacked&quot; React2Shell Is the Log4Shell of 2025, What You Need to Know About React2Shell (CVE-2025-55182).\" \/>\n<meta property=\"og:url\" content=\"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/\" \/>\n<meta property=\"og:site_name\" content=\"EncryptedFence by Certera - Web &amp; Cyber Security Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/certeraLLC\/\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-09T05:44:11+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-12-09T05:44:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/12\/react2shell-vulnerability.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"620\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Janki Mehta\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@certera_llc\" \/>\n<meta name=\"twitter:site\" content=\"@certera_llc\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Janki Mehta\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\\\/\"},\"author\":{\"name\":\"Janki Mehta\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/person\\\/e5a476aa90d9e02260ebfe4b0bf046b7\"},\"headline\":\"CVE-2025-55182: New React2Shell Vulnerability Puts Millions of Sites at Risk\",\"datePublished\":\"2025-12-09T05:44:11+00:00\",\"dateModified\":\"2025-12-09T05:44:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\\\/\"},\"wordCount\":1296,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/12\\\/react2shell-vulnerability.webp\",\"keywords\":[\"CVE-2025-55182\",\"React2Shell Attack\",\"React2Shell Vulnerability\"],\"articleSection\":[\"Vulnerability\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/certera.com\\\/blog\\\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\\\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\\\/\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\\\/\",\"name\":\"CVE-2025-55182: Every Business Using React Needs to Act Now\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/12\\\/react2shell-vulnerability.webp\",\"datePublished\":\"2025-12-09T05:44:11+00:00\",\"dateModified\":\"2025-12-09T05:44:12+00:00\",\"description\":\"\\\"Your Website Might Already Be Hacked\\\" React2Shell Is the Log4Shell of 2025, What You Need to Know About React2Shell (CVE-2025-55182).\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/certera.com\\\/blog\\\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\\\/#primaryimage\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/12\\\/react2shell-vulnerability.webp\",\"contentUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/12\\\/react2shell-vulnerability.webp\",\"width\":960,\"height\":620,\"caption\":\"React2Shell CVE-2025-55182\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/certera.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2025-55182: New React2Shell Vulnerability Puts Millions of Sites at Risk\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/\",\"name\":\"EncryptedFence by Certera - Web & Cyber Security Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\"},\"alternateName\":\"Certera's EncryptedFence Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/certera.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#organization\",\"name\":\"Certera\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/logo-encryptedfence.svg\",\"contentUrl\":\"https:\\\/\\\/certera.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/logo-encryptedfence.svg\",\"caption\":\"Certera\"},\"image\":{\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/certeraLLC\\\/\",\"https:\\\/\\\/x.com\\\/certera_llc\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/certera-llc\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/certera.com\\\/blog\\\/#\\\/schema\\\/person\\\/e5a476aa90d9e02260ebfe4b0bf046b7\",\"name\":\"Janki Mehta\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g\",\"caption\":\"Janki Mehta\"},\"description\":\"Janki Mehta is a passionate Cyber-Security Enthusiast who keenly monitors the latest developments in the Web\\\/Cyber Security industry. She puts her knowledge into practice and helps web users by arming them with the necessary security measures to stay safe in the digital world.\",\"sameAs\":[\"https:\\\/\\\/certerassl.com\\\/\"],\"url\":\"https:\\\/\\\/certera.com\\\/blog\\\/author\\\/certerabguser\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2025-55182: Every Business Using React Needs to Act Now","description":"\"Your Website Might Already Be Hacked\" React2Shell Is the Log4Shell of 2025, What You Need to Know About React2Shell (CVE-2025-55182).","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/","og_locale":"en_US","og_type":"article","og_title":"CVE-2025-55182: Every Business Using React Needs to Act Now","og_description":"\"Your Website Might Already Be Hacked\" React2Shell Is the Log4Shell of 2025, What You Need to Know About React2Shell (CVE-2025-55182).","og_url":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/","og_site_name":"EncryptedFence by Certera - Web &amp; Cyber Security Blog","article_publisher":"https:\/\/www.facebook.com\/certeraLLC\/","article_published_time":"2025-12-09T05:44:11+00:00","article_modified_time":"2025-12-09T05:44:12+00:00","og_image":[{"width":960,"height":620,"url":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/12\/react2shell-vulnerability.webp","type":"image\/jpeg"}],"author":"Janki Mehta","twitter_card":"summary_large_image","twitter_creator":"@certera_llc","twitter_site":"@certera_llc","twitter_misc":{"Written by":"Janki Mehta","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/#article","isPartOf":{"@id":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/"},"author":{"name":"Janki Mehta","@id":"https:\/\/certera.com\/blog\/#\/schema\/person\/e5a476aa90d9e02260ebfe4b0bf046b7"},"headline":"CVE-2025-55182: New React2Shell Vulnerability Puts Millions of Sites at Risk","datePublished":"2025-12-09T05:44:11+00:00","dateModified":"2025-12-09T05:44:12+00:00","mainEntityOfPage":{"@id":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/"},"wordCount":1296,"commentCount":0,"publisher":{"@id":"https:\/\/certera.com\/blog\/#organization"},"image":{"@id":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/#primaryimage"},"thumbnailUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/12\/react2shell-vulnerability.webp","keywords":["CVE-2025-55182","React2Shell Attack","React2Shell Vulnerability"],"articleSection":["Vulnerability"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/certera.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/","url":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/","name":"CVE-2025-55182: Every Business Using React Needs to Act Now","isPartOf":{"@id":"https:\/\/certera.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/#primaryimage"},"image":{"@id":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/#primaryimage"},"thumbnailUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/12\/react2shell-vulnerability.webp","datePublished":"2025-12-09T05:44:11+00:00","dateModified":"2025-12-09T05:44:12+00:00","description":"\"Your Website Might Already Be Hacked\" React2Shell Is the Log4Shell of 2025, What You Need to Know About React2Shell (CVE-2025-55182).","breadcrumb":{"@id":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/#primaryimage","url":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/12\/react2shell-vulnerability.webp","contentUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2025\/12\/react2shell-vulnerability.webp","width":960,"height":620,"caption":"React2Shell CVE-2025-55182"},{"@type":"BreadcrumbList","@id":"https:\/\/certera.com\/blog\/cve-2025-55182-new-react2shell-vulnerability-puts-millions-of-sites-at-risk\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/certera.com\/blog\/"},{"@type":"ListItem","position":2,"name":"CVE-2025-55182: New React2Shell Vulnerability Puts Millions of Sites at Risk"}]},{"@type":"WebSite","@id":"https:\/\/certera.com\/blog\/#website","url":"https:\/\/certera.com\/blog\/","name":"EncryptedFence by Certera - Web & Cyber Security Blog","description":"","publisher":{"@id":"https:\/\/certera.com\/blog\/#organization"},"alternateName":"Certera's EncryptedFence Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/certera.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/certera.com\/blog\/#organization","name":"Certera","url":"https:\/\/certera.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/certera.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2023\/08\/logo-encryptedfence.svg","contentUrl":"https:\/\/certera.com\/blog\/wp-content\/uploads\/2023\/08\/logo-encryptedfence.svg","caption":"Certera"},"image":{"@id":"https:\/\/certera.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/certeraLLC\/","https:\/\/x.com\/certera_llc","https:\/\/www.linkedin.com\/company\/certera-llc\/"]},{"@type":"Person","@id":"https:\/\/certera.com\/blog\/#\/schema\/person\/e5a476aa90d9e02260ebfe4b0bf046b7","name":"Janki Mehta","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcertera.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fhttps-vs-sftp-jpg.webp&r=g","caption":"Janki Mehta"},"description":"Janki Mehta is a passionate Cyber-Security Enthusiast who keenly monitors the latest developments in the Web\/Cyber Security industry. She puts her knowledge into practice and helps web users by arming them with the necessary security measures to stay safe in the digital world.","sameAs":["https:\/\/certerassl.com\/"],"url":"https:\/\/certera.com\/blog\/author\/certerabguser\/"}]}},"_links":{"self":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts\/4286","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/comments?post=4286"}],"version-history":[{"count":2,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts\/4286\/revisions"}],"predecessor-version":[{"id":4296,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/posts\/4286\/revisions\/4296"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/media\/4297"}],"wp:attachment":[{"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/media?parent=4286"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/categories?post=4286"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/certera.com\/blog\/wp-json\/wp\/v2\/tags?post=4286"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}