Cloudflare blames today's outage on React2Shell mitigations

Recorded: Dec. 5, 2025, 9:13 p.m.

Original

News

Featured
Latest

Critical React, Next.js flaw lets hackers execute code on servers

North Korea lures engineers to rent identities in fake IT worker scheme

CISA warns of Chinese "BrickStorm" malware attacks on VMware servers

Marquis data breach impacts over 74 US banks, credit unions

Barts Health NHS discloses data breach after Oracle zero-day hack

FBI warns of virtual kidnapping scams using altered social media photos

A Practical Guide to Continuous Attack Surface Visibility

EU fines X $140 million over deceptive blue checkmarks

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityCloudflare blames today's outage on React2Shell mitigations

Cloudflare blames today's outage on React2Shell mitigations

By Sergiu Gatlan

December 5, 2025
08:53 AM
0

Earlier today, Cloudflare experienced a widespread outage that caused websites and online platforms worldwide to go down, returning a "500 Internal Server Error" message.
The internet infrastructure company has now blamed the incident on the rollout of emergency mitigations designed to address a critical remote code execution vulnerability in React Server Components, which is now actively exploited in attacks.
"The issue was not caused, directly or indirectly, by a cyber attack on Cloudflare’s systems or malicious activity of any kind. Instead, it was triggered by changes being made to our body parsing logic while attempting to detect and mitigate an industry-wide vulnerability disclosed this week in React Server Components," Cloudflare CTO Dane Knecht noted in a post-mortem.
"A subset of customers were impacted, accounting for approximately 28% of all HTTP traffic served by Cloudflare."
Tracked as CVE-2025-55182, this maximum severity security flaw (dubbed React2Shell) affects the React open-source JavaScript library for web and native user interfaces, as well as dependent React frameworks such as Next.js, React Router, Waku, @parcel/rsc, @vitejs/plugin-rsc, and RedwoodSDK.
The vulnerability was found in the React Server Components (RSC) 'Flight' protocol, and it allows unauthenticated attackers to gain remote code execution in React and Next.js applications by sending maliciously crafted HTTP requests to React Server Function endpoints.
While multiple React packages in their default configuration (i.e., react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack) are vulnerable, the flaw only affects React versions 19.0, 19.1.0, 19.1.1, and 19.2.0 released during the past year.
Ongoing React2Shell exploitation
Although the impact is not as widespread as initially believed, security researchers with Amazon Web Services (AWS) have reported that multiple China-linked hacking groups (including Earth Lamia and Jackpot Panda) have begun exploiting the React2Shell vulnerability hours after the max-severity flaw was disclosed.
The NHS England National CSOC also said on Thursday that several functional CVE-2025-55182 proof-of-concept exploits are already available and warned that "continued successful exploitation in the wild is highly likely."
Last month, Cloudflare experienced another worldwide outage that brought down the company's Global Network for almost 6 hours, an incident described by CEO Matthew Prince as the "worst outage since 2019."
Cloudflare fixed another massive outage in June, which caused Access authentication failures and Zero Trust WARP connectivity issues across multiple regions, and also impacted Google Cloud's infrastructure.
Update December 05, 11:38 EST: Revised story and title based on a post-mortem shared by Cloudflare CTO Dane Knecht.

Break down IAM silos like Bitpanda, KnowBe4, and PathAI
Broken IAM isn't just an IT problem - the impact ripples across your whole business.
This practical guide covers why traditional IAM practices fail to keep up with modern demands, examples of what "good" IAM looks like, and a simple checklist for building a scalable strategy.
Get the guide

Related Articles:
Cloudflare down, websites offline with 500 Internal Server ErrorCloudflare blames this week's massive outage on database issuesCloudflare hit by outage affecting Global Network servicesCritical React2Shell flaw actively exploited in China-linked attacksCritical React, Next.js flaw lets hackers execute code on servers

Cloudflare
Outage
Patch
React2Shell

Sergiu Gatlan
Sergiu is a news reporter who has covered the latest cybersecurity and technology developments for over a decade. Email or Twitter DMs for tips.

Previous Article
Next Article

Popular Stories

ChatGPT is down worldwide, conversations disappeared for users

Cloudflare down, websites offline with 500 Internal Server Error

Marquis data breach impacts over 74 US banks, credit unions

Sponsor Posts

Hackers love the holidays! Share FREE Security Awareness Training to keep family & friends cyber-safe!

AI is a data-breach time bomb: Read the new report

Overdue a password health-check? Audit your Active Directory for free

What you’re overlooking to protect your business

Empowering IT teams with intelligence driven cyber threat research.

Upcoming Webinar

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Username

Password

Remember Me

Not a member yet? Register Now

Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

Cloudflare experienced a significant global outage on December 5, 2025, impacting websites and online platforms worldwide with “500 Internal Server Error” messages. The incident is attributed to emergency mitigations implemented in response to a newly disclosed, maximum-severity security vulnerability dubbed React2Shell, affecting React Server Components (RSC) and related frameworks. Approximately 28% of Cloudflare’s HTTP traffic was impacted by these changes.

The vulnerability, tracked as CVE-2025-55182, resides within the “Flight” protocol used in React Server Components and specifically targets React versions 19.0 through 19.2.0 released within the past year. Attackers can leverage this flaw to execute remote code execution in React and Next.js applications by sending specifically crafted HTTP requests to React Server Function endpoints. While the initial scope appeared limited, security researchers with Amazon Web Services (AWS) quickly reported active exploitation by China-linked hacking groups, including Earth Lamia and Jackpot Panda, shortly after the vulnerability's public disclosure. The National Health Service (NHS) England’s National CSOC also confirmed the availability of functional proof-of-concept exploits and predicted widespread exploitation.

This event follows a notable previous outage in June 2025, involving Access authentication failures and disruptions to Cloudflare’s Global Network, impacting Google Cloud infrastructure. Cloudflare’s Chief Technology Officer, Dane Knecht, described this incident as the firm’s most significant outage since 2019. The rapid exploitation of React2Shell underscores the urgency of the situation, with the NHS warning of likely continued successful attacks. The discovery highlights the complexities of managing vulnerabilities within server-side rendering technologies and the potential for rapid propagation of risks across interconnected systems. Cloudflare’s response demonstrates the organization's commitment to mitigating emerging threats, but the incident serves as a reminder of the ongoing need for vigilance and proactive security measures within the broader internet ecosystem.