React2shell: CVE-2025-66478 and CVE-2025-55182 #517

New Issue

MrUnknownDE · 2026-04-05T17:15:08+02:00

MrUnknownDE commented

2026-04-05 17:15:08 +02:00

Originally created by @dzatoah on 12/10/2025

Describe the Bug

If I'm right, then pangolin:latest docker image is affected by the React2Shell vulnerability, rated with 10/10.
Please upgrade Next.js and React ASAP!

https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp
https://react2shell.com/

How to test if your instance is affected:

cve.yaml:

id: cve-2025-55182-react2shell

info:
  name: React2Shell (CVE-2025-55182) Detection
  author: SecurityResearchTeam
  severity: critical
  description: Detects unauthenticated RCE in React Server Components via unsafe deserialization.
  tags: cve,cve2025,react,rce,nextjs

requests:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Next-Action: {{rand_text_alphanumeric(10)}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactScan
        
        ------WebKitFormBoundaryReactScan
        Content-Disposition: form-data; name="1"
        
        {"then": null}
        ------WebKitFormBoundaryReactScan--

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 500
      - type: word
        part: body
        words:
          - "React Server Components Error"
          - "Minified React error"
          - "digest"
          - "react-server-dom-webpack"

targets.txt:

https://pangolin.example.org

nuclei -l targets.txt -t cve.yaml -debug

Environment

OS Type & Version: Debian 13
docker.io/fosrl/pangolin:latest
docker.io/fosrl/gerbil:latest
docker.io/traefik:latest

Output of Nuclei of affected machine:

__     _
____  __  _______/ /__  (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.6.0

projectdiscovery.io

[WRN] Found 1 templates loaded with deprecated protocol syntax, update before v3 for continued support.
[INF] Current nuclei version: v3.6.0 (latest)
[INF] Current nuclei-templates version: v10.3.5 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 57
[INF] Templates loaded for current scan: 1
[WRN] Loading 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[INF] [cve-2025-55182-react2shell] Dumped HTTP request for https://pangolin.*******.**

POST / HTTP/1.1
Host: pangolin.*******.**
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.3 Safari/605.1.15
Connection: close
Content-Length: 132
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactScan
Next-Action: UGUgfoXHBR
Accept-Encoding: gzip

------WebKitFormBoundaryReactScan
Content-Disposition: form-data; name="1"

{"then": null}
------WebKitFormBoundaryReactScan--
[DBG] [cve-2025-55182-react2shell] Dumped HTTP response https://pangolin.******.**

HTTP/1.1 500 Internal Server Error
Connection: close
Transfer-Encoding: chunked
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Type: text/x-component
Date: Wed, 10 Dec 2025 12:48:58 GMT
Vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding
X-Powered-By: Express

0:{"a":"$@1","f":"","b":"TjfB-qJFPon4RUNhdqJX3"}
1:E{"digest":"1664348887"}
[cve-2025-55182-react2shell:status-1] [http] [critical] https://pangolin.*****.**
[cve-2025-55182-react2shell:word-2] [http] [critical] https://pangolin.*****.**
[INF] Scan completed in 599.479665ms. 2 matches found.

*Originally created by @dzatoah on 12/10/2025* ### Describe the Bug If I'm right, then `pangolin:latest `docker image is affected by the React2Shell vulnerability, rated with **10/10**. Please upgrade Next.js and React ASAP! https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp https://react2shell.com/ How to test if your instance is affected: cve.yaml: ```yaml id: cve-2025-55182-react2shell info: name: React2Shell (CVE-2025-55182) Detection author: SecurityResearchTeam severity: critical description: Detects unauthenticated RCE in React Server Components via unsafe deserialization. tags: cve,cve2025,react,rce,nextjs requests: - raw: - | POST / HTTP/1.1 Host: {{Hostname}} Next-Action: {{rand_text_alphanumeric(10)}} Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactScan ------WebKitFormBoundaryReactScan Content-Disposition: form-data; name="1" {"then": null} ------WebKitFormBoundaryReactScan-- matchers-condition: and matchers: - type: status status: - 500 - type: word part: body words: - "React Server Components Error" - "Minified React error" - "digest" - "react-server-dom-webpack" ``` targets.txt: ``` https://pangolin.example.org ``` `nuclei -l targets.txt -t cve.yaml -debug` ### Environment - OS Type & Version: Debian 13 - docker.io/fosrl/pangolin:latest - docker.io/fosrl/gerbil:latest - docker.io/traefik:latest ### Output of Nuclei of affected machine: ``` __ _ ____ __ _______/ /__ (_) / __ \/ / / / ___/ / _ \/ / / / / / /_/ / /__/ / __/ / /_/ /_/\__,_/\___/_/\___/_/ v3.6.0 projectdiscovery.io [WRN] Found 1 templates loaded with deprecated protocol syntax, update before v3 for continued support. [INF] Current nuclei version: v3.6.0 (latest) [INF] Current nuclei-templates version: v10.3.5 (latest) [WRN] Scan results upload to cloud is disabled. [INF] New templates added in latest release: 57 [INF] Templates loaded for current scan: 1 [WRN] Loading 1 unsigned templates for scan. Use with caution. [INF] Targets loaded for current scan: 1 [INF] [cve-2025-55182-react2shell] Dumped HTTP request for https://pangolin.*******.** POST / HTTP/1.1 Host: pangolin.*******.** User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.3 Safari/605.1.15 Connection: close Content-Length: 132 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactScan Next-Action: UGUgfoXHBR Accept-Encoding: gzip ------WebKitFormBoundaryReactScan Content-Disposition: form-data; name="1" {"then": null} ------WebKitFormBoundaryReactScan-- [DBG] [cve-2025-55182-react2shell] Dumped HTTP response https://pangolin.******.** HTTP/1.1 500 Internal Server Error Connection: close Transfer-Encoding: chunked Cache-Control: no-cache, no-store, max-age=0, must-revalidate Content-Type: text/x-component Date: Wed, 10 Dec 2025 12:48:58 GMT Vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding X-Powered-By: Express 0:{"a":"$@1","f":"","b":"TjfB-qJFPon4RUNhdqJX3"} 1:E{"digest":"1664348887"} [cve-2025-55182-react2shell:status-1] [http] [critical] https://pangolin.*****.** [cve-2025-55182-react2shell:word-2] [http] [critical] https://pangolin.*****.** [INF] Scan completed in 599.479665ms. 2 matches found. ```

MrUnknownDE closed this issue

2026-04-05 17:15:08 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#517