PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182

What it is

Huntress's write-up of active exploitation of CVE-2025-55182 ("React2Shell"), a CVSS 10.0 unauthenticated RCE in React Server Components. The page adds a timeline the summary does not: the flaw was publicly disclosed December 3 (with the React team urging immediate upgrade), and Huntress observed threat actors targeting numerous organizations as of December 8, spanning sectors including construction and entertainment.

How it works

The exploit abuses React Server Components' handling of the React Flight protocol's Chunks. The page walks through the primitive more concretely than the summary:

• Chunks are referenced with the $@ token.
• The attacker forges chunk 0 with a status of resolved_model, tricking React Flight into believing the chunk's data is already fulfilled — i.e., forging the request lifecycle to appear further along than it is.
• When chunk 1 is evaluated, React sees it is "thenable" (has a then method), refers back to chunk 0, and attempts to resolve the forged then method — handing the attacker control of the resolution code path.
• When _formData.get is set to a value resolving to a constructor, React treats that field as a constructor reference to hydrate during blob processing — the step that leads to code execution. (The page text is truncated at this point.)

Attribution: the exploit was discovered by researcher Lachlan Davidson; the MRE referenced is from Vercel CEO Guillermo Rauch.

Preconditions / Affected

Any application running vulnerable React Server Components / React Flight is exposed — the attack is unauthenticated and requires only a single crafted HTTP request. No privileges or configuration on the attacker side are needed.

What to do

The page's only stated remediation is patch immediately ("immediate upgrade," per the React team), justified by the low feasibility barrier and confirmed in-the-wild exploitation. Note for tracking: CVE-2025-66478, which you may see referenced for the downstream Next.js effects, has been rejected as a duplicate of CVE-2025-55182 — track the single upstream ID.

Caveats

The fetched text is truncated mid-sentence in the exploit walkthrough, and the promised detailed sections on post-exploitation activity, the four named malware families (PeerBlight, CowTunnel, ZinFoq, Kaiji variant), and any IOCs or specific detections are not present in the captured content. No fixed version numbers, hashes, or detection rules appear in the text available here.