Critical JavaScript Library Vulnerability Poses Serious Risks to Crypto Sites

A major security flaw within React’s Server Components has raised alarms throughout the cryptocurrency sector. Cybercriminals are taking immediate advantage of this vulnerability to siphon funds and install malware on affected websites, prompting a call for urgent action from all crypto platforms.

Key Takeaways

A significant security vulnerability in React (CVE-2025-55182) is being exploited by hackers.
The flaw impacts all sites using React, including Web3 platforms, allowing attackers to intercept wallet communications.
React’s official team has rated the vulnerability as critical, with a maximum CVSS score of 10.0.
Major frameworks, including Next.js, require immediate updates to protect against the exploit.
Coordinated attacks from multiple threat groups have been documented since the vulnerability’s disclosure, leading to increased risks of malware and crypto-mining activities.

Critical JavaScript Library Vulnerability Poses Serious Risks to Crypto Sites

Urgent Actions Needed to Address the Vulnerability

Details on the React Vulnerability

On December 3, React’s official team revealed a critical vulnerability (CVE-2025-55182), which received a CVSS score of 10.0 after a report by Lachlan Davidson via Meta Bug Bounty on November 29. This flaw allows unauthorized remote code execution, exploiting how React deciphers payloads sent to Server Function endpoints. Attackers can send harmful HTTP requests, executing arbitrary code on servers.

This vulnerability affects various versions of React, notably 19.0, 19.1.0, 19.1.1, and 19.2.0, across packages like react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. Key frameworks, including Next.js, React Router, Waku, and Expo, need immediate updates. Patches were released in versions 19.0.1, 19.1.2, and 19.2.1, with Next.js users needing upgrades across multiple versions.

Unfortunately, researchers have identified two additional significant flaws following the initial disclosure. To bolster security, Vercel has installed Web Application Firewall (WAF) rules for its platform projects but stressed that WAF alone isn't enough protection. “Immediate upgrades to a patched version are required,” Vercel noted in its December 3 security bulletin, highlighting that the vulnerability affects applications that process untrusted input in ways that allow remote code execution.

Coordinated Attacks From Various Threat Groups

According to the Google Threat Intelligence Group, extensive attacks began on December 3, involving a mix of opportunistic hackers and state-sponsored groups. Chinese hacking entities have compromised systems to install diverse types of malware, primarily focusing on cloud services like Amazon Web Services and Alibaba Cloud.

These attackers are using advanced methods to maintain prolonged access to the victim systems. Some have set up covert software to create hidden control access, while others continually download and disguise additional malicious tools as legitimate applications. This malware typically resides in system directories and is designed to restart automatically, evading detection.

Starting on December 5, financially driven criminals joined the assault, secretly installing crypto-mining software that uses the computing resources of victims’ machines to generate Monero. This hidden mining process runs in the background, increasing electricity costs for victims while generating profits for the attackers. Hacking forums have become active spaces for sharing tools and experiences related to these exploitations.

Ongoing Supply Chain Attack Trends

This vulnerability in React follows a significant supply chain attack that occurred on September 8, where hackers compromised Josh Goldberg’s npm account, injecting malicious updates into 18 commonly used packages like chalk, debug, and strip-ansi. These tools see over 2.6 billion weekly downloads, and researchers have found crypto-clipper malware that hijacks browser functions to swap legitimate wallet addresses with those controlled by attackers.

Ledger CTO Charles Guillemet characterized this incident as a “large-scale supply chain attack,” advising users who do not use hardware wallets to refrain from conducting on-chain transactions. In the first half of 2025, global data showed that hackers stole more than $3 billion across 119 incidents, with 70% of breaches involving funds that were moved before they became public knowledge. Unfortunately, only 4.2% of the stolen assets have been recovered, as laundering now occurs in mere seconds, rather than hours.

Organizations utilizing React or Next.js should immediately patch to versions 19.0.1, 19.1.2, or 19.2.1. They are also advised to deploy WAF rules, audit all dependencies, monitor network traffic for suspicious wget or cURL commands initiated by web servers, and search for unauthorized hidden directories or harmful shell configurations.