Critical React Native Metro Flaw (CVE-2025-11953) Exploited in Dev System Breaches

React Native Metro Server Vulnerability Exploited in Targeted Attacks

Security researchers have confirmed active exploitation of CVE-2025-11953, a critical vulnerability in the Metro server for React Native, enabling threat actors to compromise developer systems with Windows and Linux malware.

Key Details

• Vulnerability: CVE-2025-11953 (CVSS score pending)
• Affected Component: Metro server (React Native's JavaScript bundler)
• Attack Vector: Remote code execution (RCE) via crafted requests
• Targeted Platforms: Windows and Linux development environments
• Discovery: Reported by security firm SonarSource in February 2025

Technical Analysis

The flaw stems from improper input validation in Metro's HTTP server, which listens on localhost:8081 by default during React Native app development. Attackers can exploit this by sending specially crafted requests to the server, bypassing security controls and executing arbitrary code with the privileges of the Metro process.

Exploitation Requirements:

• Metro server must be running (common during app development)
• Attacker requires network access to the target system (e.g., via compromised dependencies or phishing)

Impact and Risks

1. Supply Chain Threat: Compromised developer systems can lead to malicious code injection in React Native applications, potentially affecting downstream users.
2. Lateral Movement: Attackers may pivot from breached dev environments to production systems or corporate networks.
3. Data Theft: Sensitive intellectual property, API keys, or credentials stored in development environments are at risk.

Mitigation and Recommendations

Security teams and developers should take immediate action:

1. Patch Management:

   • Update to the latest React Native version (patch released March 5, 2025).
   • Apply Metro server security updates provided by the React Native team.

2. Workarounds:

   • Disable the Metro server when not in active use.
   • Restrict access to localhost:8081 via firewall rules or network segmentation.

3. Monitoring:

   • Deploy EDR/XDR solutions to detect anomalous process execution on developer workstations.
   • Monitor for unusual outbound connections from development environments.

4. Secure Development Practices:

   • Audit third-party dependencies for signs of compromise.
   • Enforce least-privilege access for development tools.

Indicators of Compromise (IOCs)

While specific IOCs are not yet public, organizations should investigate:

• Unexpected processes spawned by node.exe or metro on Windows/Linux systems.
• Suspicious network traffic to/from localhost:8081.
• Unauthorized modifications to React Native project files.

Note: CVE-2025-11953 underscores the growing trend of targeting developer tools as an entry point for supply chain attacks. Security teams should prioritize hardening development environments alongside production systems.