CVE-2025-55182 is a critical unauthenticated RCE in React Server Components affecting…
CVE-2025-55182 is a critical unauthenticated RCE in React Server Components affecting Next.js, with public exploits and active mass scanning observed since December 3, 2024.
On December 3, 2024, a remote code execution vulnerability (CVE-2025-55182) was disclosed in React Server Components, affecting the popular Next.js framework when using the App Router feature. The vulnerability is a server-side prototype pollution issue that allows unauthenticated attackers to execute arbitrary commands on affected servers. Next.js tracks this as CVE-2025-66478 and has released patches for versions 15.x and 16.x. Public proof-of-concept code emerged within 24 hours, with the first working exploit published by security researcher Moritz Sanft on December 4. Datadog researchers confirmed exploitation is trivial, including against default applications created by create-next-app scaffolding.
Active exploitation began within hours of disclosure, with Datadog telemetry identifying over 800 IP addresses conducting scanning and exploitation attempts as of December 5. Initial scanning used non-functional payloads, but shifted to weaponized exploits once working PoCs became available. Observed malicious payloads include .env file exfiltration, cryptocurrency miner deployment, botnet recruitment scripts, and persistence mechanisms including web shell injection. The vulnerability requires only HTTP POST requests with specially crafted JSON payloads to the Next-Action header, making exploitation straightforward for threat actors.
Organizations running Next.js versions 15.x, 16.x, or 14.3.0-canary.77 and later should immediately upgrade to patched releases (15.0.5+, 15.1.9+, 15.2.6+, 15.3.6+, 15.4.8+, 15.5.7+, or 16.0.7+). The server-side prototype pollution technique exploits JavaScript's prototype chain to inject malicious properties into spawned processes, particularly targeting child_process.execSync calls. This vulnerability represents a significant threat to the JavaScript server-side ecosystem given Next.js's widespread adoption.
Mentioned in this report
Detection guidance
Node.js Web Server Spawning Shell After Next.js RCE Exploitation
Detects a Node.js/Next.js server process spawning a shell or interpreter and executing download/exfiltration commands, consistent with CVE-2025-55182 prototype-pollution RCE reaching child_process.execSync. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Server Spawning Shell Consistent With Next.js RCE
id: d729925e-da62-5efc-b215-3fb6435b3640
status: experimental
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- node
- next-server
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /curl
- /wget
selection_cmd:
CommandLine|contains:
- curl
- wget
- base64
- /etc/passwd
- .env
- chmod +x
filter_build:
CommandLine|contains:
- npm install
- next build
- node_modules/.bin
condition: selection_parent and selection_child and selection_cmd and not filter_build
falsepositives:
- CI/CD pipelines that build or deploy Next.js apps and legitimately shell out from
node
- Custom build scripts invoking curl/wget for dependency fetching during deployment
level: high
tags:
- attack.t1190
- attack.t1059.004
- attack.t1505.003
author: Vorant
Environment File Access or Exfiltration by Web Server Process
Detects a Node.js/Next.js web server process (or its child shell) reading or transferring the .env file, matching the credential-harvesting payloads observed in CVE-2025-55182 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Dotenv File Read or Exfiltration From Node Web Process
id: bdb88d75-79cc-53d8-9e3b-ddb8505ef7b9
status: experimental
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- node
- next-server
selection_env:
CommandLine|contains:
- .env
selection_action:
Image|endswith:
- /cat
- /curl
- /wget
- /nc
- /base64
condition: selection_parent and selection_env and selection_action
falsepositives:
- Legitimate configuration management or deployment tooling that reads .env files
from a node parent process
- Developer debugging scripts run under a node process manager (e.g. pm2) that cat
local .env for troubleshooting
level: high
tags:
- attack.t1552.001
- attack.t1567.002
- attack.t1190
author: Vorant
HTTP POST With Next-Action Header and Prototype Pollution Payload
Detects inbound HTTP POST requests carrying a Next-Action header combined with prototype-pollution style payload keys (__proto__/constructor), the mechanism used to trigger CVE-2025-55182 against Next.js App Router endpoints. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Next.js Server Action Request With Prototype Pollution Indicators
id: cb541481-293d-5313-832a-2cf898a0493f
status: experimental
logsource:
category: proxy
product: null
detection:
selection_method:
cs-method: POST
selection_header:
cs-headers|contains: Next-Action
selection_payload:
cs-uri-query|contains:
- __proto__
- constructor.prototype
- constructor%5Bprototype%5D
condition: selection_method and selection_header and selection_payload
falsepositives:
- Legitimate Next.js Server Action calls that coincidentally reference constructor/prototype
identifiers in JSON payloads (rare in normal app traffic)
level: medium
tags:
- attack.t1071.001
- attack.t1190
- attack.t1595.002
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://securitylabs.datadoghq.com/articles/cve-2025-55182-react2shell-remote-code-execution-react-server-components/
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free