.svg)
A critical flaw in React Server Components is being actively abused to hijack websites and potentially empty users’ crypto wallets, according to security researchers. The issue, tracked as CVE-2025-55182 and nicknamed React2Shell, affects React versions 19.0 through 19.2.0 and related packages that are widely used in frameworks such as Next.js. React’s maintainers disclosed the bug on December 3 and gave it the highest severity score, but thousands of sites remain unpatched, including crypto platforms that handle live wallet interactions.
The vulnerability sits in the way React decodes requests to server side components. By sending a specially crafted web request, an attacker can trick an affected server into running arbitrary commands with no need to log in first, effectively gaining remote control of the system. Security teams at Google’s Threat Intelligence Group say they have already seen multiple campaigns use the bug to compromise unpatched React and Next.js deployments across cloud environments.
Once inside, attackers are installing a mix of malware, backdoors and crypto mining tools. Several observed campaigns have dropped Monero mining software that silently burns through the victim’s compute resources and power bills to generate income for the attacker. Others focus on persistence and access, planting backdoors that allow repeated entry even if the initial weakness is later patched.
For crypto users, the most worrying angle is the front end. Many exchanges, DeFi dashboards and wallet interfaces rely on React for key flows such as transaction signing, token approvals and wallet connection. If an attacker compromises the website that sits on top of a protocol, they can inject malicious scripts that watch or alter those interactions, for example by redirecting a payment to their own address, even though the underlying blockchain remains technically secure. That makes this bug a serious threat for anyone who signs transactions directly in a browser.
Security researchers are urging teams that use React 19.x or server components in general to treat this as an emergency patch situation. Even simply having the vulnerable packages installed can be enough to create an entry point, so operators are being told to update dependencies, audit code paths that use server components and watch infrastructure closely for signs of unexpected processes such as unauthorized miners. Until patches are applied and deployments are checked, the combination of remote code execution and wallet facing front ends gives attackers a powerful way to turn a single web bug into drained accounts.
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)