Campaign Report: React Server Components RCE Scanning (CVE-2025-55182)

Deployment Period: 2026/02/01 to 2026/02/28

Honeypot: T-Pot Community Edition, Google Cloud Platform

Data Source: Elasticsearch DSL queries, Kibana Dev Tools

TLP: TLP:CLEAR

About This Report

This report is part of a hands-on project focused on building practical skills in threat data analysis and CVE research. It is one report in an ongoing series covering the February 2026 T-Pot deployment.

Summary

CVE-2025-55182 is a remote code execution flaw in React Server Components, disclosed on 2025/12/03. It produced 1,527 events across all 28 days of the deployment. Activity was highest in the first two weeks and steadily declined through the end of February, ending at just 8 events on 2026/02/28. That pattern fits with opportunistic scanning that followed a high-profile public disclosure and slowed as patches were applied.

Background

CVE-2025-55182, nicknamed React2Shell, is a remote code execution flaw in React Server Components. An attacker sends a single HTTP POST request with no credentials and the server runs their code. Default configurations are affected. It was disclosed on 2025/12/03 with patches available the same day. CISA added it to their Known Exploited Vulnerabilities catalog two days later on 2025/12/05.

A second CVE, CVE-2025-66478, was initially assigned for the same flaw as it appears in Next.js but was rejected as a duplicate. Both IDs point to the same issue.

Findings

Emergence and Peak

Activity was present from day one. The vulnerability was already two months old by 2026/02/01. The first week averaged around 58 events per day. The highest single day was 2026/02/07 with 140 events, with a second rise to 103 on 2026/02/19.

Decline

The second half of the month was quieter. The final week averaged 26 events per day and the last day recorded just 8 events. The downward trend suggests patch uptake reduced the number of reachable targets, though this honeypot alone cannot confirm that.

Analysis

When this CVE was disclosed in December 2025, exploitation started within hours. Google Threat Intelligence Group documented multiple attacker clusters including cybercriminals and suspected espionage groups. Microsoft confirmed exploitation by 2025/12/05. Post-exploitation payloads in the wild included cryptocurrency miners, Cobalt Strike, and backdoors including SNOWLIGHT and COMPOOD.

By February the wave had settled. The honeypot data shows the tail end of that activity declining as patches spread. These are Suricata IDS matches, not confirmed exploitation. The honeypot does not run React Server Components.

Defender Notes

Patch to the fixed versions: react-server 19.0.1, 19.1.2, or 19.2.1. For Next.js, see the patch version for your release line on the React advisory page.

CVE-2025-66478 was rejected as a duplicate of CVE-2025-55182. If your detection tooling references either ID, it is flagging the same vulnerability.

Data Reference

Table 1: Monthly Summary

Table 2: Daily Event Counts

Table 3: Vulnerability Scoring

Methodology Notes

Event counts reflect IDS alerts, not confirmed exploitation. The honeypot does not run React Server Components. These are inbound probing attempts only.

CVSS sourcing: NVD had not completed its analysis at the time of this deployment. The score of 10.0 comes from the CNA, which is Meta. This is standard practice when NVD analysis is pending.

All data sourced from Elasticsearch DSL queries against T-Pot honeypot logs, 2026/02/01 through 2026/02/28. Raw query output is preserved in honeypot-threat-research/data.

References