TLDR
There is no public, comprehensive list of crypto sites that have confirmed patching the recent React exploit. The fixes were shipped upstream in React and major frameworks, and many teams likely applied them quietly.
- React maintainers released patched versions (19.0.1, 19.1.2, 19.2.1) after disclosure on Dec 3, enabling sites to remediate quickly React fix noted here.
- Framework and infra teams, including Vercel and Meta, pushed mitigations and WAF rules to protect apps while patches rolled out as reported.
- Security groups report active exploitation and broad risk to unpatched sites, but few projects have posted named we patched bulletins publicly industry warning.
Deep Dive
1. Upstream Fixes
The vulnerability (CVE-2025-55182, often called React2Shell) enables remote code execution in React Server Components. React shipped fixes on Dec 3, and projects can remediate by upgrading to patched releases. This puts the primary responsibility on each site to update promptly React fix noted here.
These updates are the fastest path to safety because they remove the underlying flaw rather than only blocking known exploit patterns. Many production stacks depend on React frameworks, so upstream patches propagate quickly when teams upgrade.
If a crypto site runs a patched React or framework version, it is largely protected from the known exploit path.
2. Who Said They Patched
Public, project-specific confirmations remain scarce. Coverage highlights that Vercel and Meta pushed mitigations and WAF rules, and framework teams issued updates, but does not name specific crypto exchanges, wallets, or dapps as having patched in a formal bulletin reported here.
Media and security advisories emphasize widespread exploitation and urgent patching rather than naming which sites completed remediation. That pattern is common for web stack CVEs, where teams quietly patch without individual press releases industry warning.
Absence of a public post does not imply a site is unpatched. Many teams update silently and may only post if there was user impact.
3. Practical Verification
There is no authoritative roll?up of patched crypto sites for this CVE. To verify a specific platform, the most reliable checks are its security or status page, recent blog posts, or incident updates. If none exist, assume standard practice applies and the team patched upstream dependencies without a public note.
If you share the names of the sites you care about, I can check their official channels for a security or maintenance post and summarize any confirmations.
Focus on the few platforms you use. Look for a recent security or maintenance post, and be cautious with unexpected signature prompts until you see clear remediation.
Conclusion
Fixes for CVE-2025-55182 landed upstream, and framework and infra providers added mitigations, but there is no public, complete list of crypto sites that have confirmed patching. The most actionable path is to verify specific platforms via their status or security pages and avoid signing unexpected approvals while exploit activity remains elevated.
CoinsKid.Com