Cato CTRL™ Threat Brief: “React2Shell” Vulnerability Targeting React Server Components

**Executive Summary:** A critical remote code execution vulnerability named React2Shell (CVE-2025-55182) in React Server Components was disclosed and followed by public PoCs, triggering mass scanning and more than 10,000 exploitation attempts targeting multiple sectors and frameworks (react-server-dom-* packages, Next.js, Vite, Parcel plugins, Redwood SDK, etc.); Cato CTRL observed diverse payloads, exploitation patterns including prototype pollution, and activity attributed to state-nexus groups, and deployed IPS protections across its SASE platform.