Forest Global Training Partners

Cyber Risks · PortSwigger Research

Professional / Community 2025.11.3

Summary: PortSwigger released Burp Suite Professional and Community 2025.11.3 on 8 December 2025, adding a new active scan check for React2Shell, a critical remote code execution vulnerability affecting React Server Components in React and Next.js, tracked as CVE-2025-55182 and CVE-2025-66478. The check is enabled by default and runs once per host, and the release also upgrades Burp's browser to Chromium 143.0.7499.41 on Windows and Mac and 143.0.7499.40 on Linux.

What's compelling: React2Shell is a critical remote code execution flaw in React Server Components and Next.js, and the scanner check that detects it now runs by default once per host - so any host your teams scan without knowing this is enabled will be probed for it.

Read the original at PortSwigger Research ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2025-55182CVE-2025-66478
Related