Security teams scrambling to protect their organizations from the maximum-severity, highly exploitable React2Shell vulnerability in React Server Components (RSC) now have two more – though less dangerous – security flaws to address.

The React team this week said the two additional vulnerabilities in RSC, if exploited by bad actors, could result in denial-of-service (DoS) attacks or exposed source code. The team said security researchers uncovered the bugs while testing the patches React and Next.js released last week to address the remote code execution (RCE) exploit, which is tracked as CVE-2025-55182.

“It’s common for critical CVEs to uncover follow‑up vulnerabilities,” the React team wrote in a notice this week. “When a critical vulnerability is disclosed, researchers scrutinize adjacent code paths looking for variant exploit techniques to test whether the initial mitigation can be bypassed.”

“Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle,” the React team wrote.

The fix released last week for React2Shell remains effective, the team wrote.

Starting with Malicious HTTP Requests

The two newly discovered security flaws include a high-severity (CVSS 7.5) DoS vulnerability tracked as CVE-2025-55184 and CVE-2025-67779. The other bug – with a medium severity score of 5.3 – tracked as CVE-2025-55183.

The React team released patches for the vulnerabilities, which affect the same 10 packages and versions of RSC versions as the critical React2Shell flaw. The team is urging organizations to apply the patches immediately.

For the DoS vulnerability, security researchers found that threat actors could craft a malicious HTTP request and send it to any Server Functions endpoint. When it’s deserialized by React, it can create an “infinite loop that hangs the server process and consumes CPU,” the team wrote. “Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.”

The result is the attacker may be able to deny users access to the product and possibly impact the performance of the server. The patches for the bug are designed to prevent the infinite loop.

Exposing Source Code

Similarly, with the other security flaw, hackers can send a malicious HTTP request to a vulnerable Server Function, which may return the source code of any Server Function.

“Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument,” allowing for the source code leak, team members wrote.

“Only secrets in source code may be exposed,” they added. “Secrets hardcoded in source code may be exposed, but runtime secrets such as process.env.SECRET are not affected. The scope of the exposed code is limited to the code inside the Server Function, which may include other functions depending on the amount of inlining your bundler provides.”

In their own blog post, Josh Story and Sebastian Markbåge, software engineers with Vercel, the creator of Next.js, wrote that the vulnerability “could reveal business logic. Secrets could also be exposed if they are defined directly in your code (rather than accessed via environment variables at runtime) and referenced within a Server Function. Depending on your bundler configuration, these values may be inlined into the compiled function output.”

Users need to always verify against production bundles, the React team wrote.

React2Shell Under Attack

Both noted that the DoS vulnerability was discovered by security researchers RyotaK from GMO Flatt Security and Shinsaku Nomura of Bitforest, while Andrew MacPherson reported the source code exposure.

All this comes as a rapidly widening field of nation-state and financially motivated threat groups from around the globe are furiously trying to exploit the React2Shell RCE vulnerability, using an expanding arsenal of threats, from backdoors and botnets to cryptocurrency miners, information-stealers, and reconnaissance probes.

The broad use of RSC and frameworks that rely on it – Wiz noted that 39% of cloud environments contain React or Next.js – combined with the easy exploitability makes React2Shell an attractive target for bad actors.

“The widespread deployment of vulnerable React 19.x RSC packages is alarming, coupled with rapid weaponization, readily available public exploits, and convenient Metasploit modules,” said Noelle Murata, senior security engineer for cybersecurity firm Xcape. “This lowers the skill barrier for attackers, facilitating rapid duplication and propagation. … Delaying patching is not risk management; it’s a gamble.”