# CVE-2025-55182 is a critical unauthenticated RCE in React Server Components affecting…

Published: 2026-06-04 · Severity: critical
Canonical: https://vorant.io/reports/481764f2-ea26-4054-b3aa-b66a93163995/cve-2025-55182-is-a-critical-unauthenticated-rce-in-react-server-components

> CVE-2025-55182 is a critical unauthenticated RCE in React Server Components affecting Next.js, with public exploits and active mass scanning observed since December 3, 2024.

On December 3, 2024, a remote code execution vulnerability (CVE-2025-55182) was disclosed in React Server Components, affecting the popular Next.js framework when using the App Router feature. The vulnerability is a server-side prototype pollution issue that allows unauthenticated attackers to execute arbitrary commands on affected servers. Next.js tracks this as CVE-2025-66478 and has released patches for versions 15.x and 16.x. Public proof-of-concept code emerged within 24 hours, with the first working exploit published by security researcher Moritz Sanft on December 4. Datadog researchers confirmed exploitation is trivial, including against default applications created by create-next-app scaffolding.

Active exploitation began within hours of disclosure, with Datadog telemetry identifying over 800 IP addresses conducting scanning and exploitation attempts as of December 5. Initial scanning used non-functional payloads, but shifted to weaponized exploits once working PoCs became available. Observed malicious payloads include .env file exfiltration, cryptocurrency miner deployment, botnet recruitment scripts, and persistence mechanisms including web shell injection. The vulnerability requires only HTTP POST requests with specially crafted JSON payloads to the Next-Action header, making exploitation straightforward for threat actors.

Organizations running Next.js versions 15.x, 16.x, or 14.3.0-canary.77 and later should immediately upgrade to patched releases (15.0.5+, 15.1.9+, 15.2.6+, 15.3.6+, 15.4.8+, 15.5.7+, or 16.0.7+). The server-side prototype pollution technique exploits JavaScript's prototype chain to inject malicious properties into spawned processes, particularly targeting child_process.execSync calls. This vulnerability represents a significant threat to the JavaScript server-side ecosystem given Next.js's widespread adoption.

## Mentioned in this report

- Vulnerabilities: CVE-2025-55182 (KEV), CVE-2025-66478 (weaponized)

## Detection guidance (public sample)

### Node.js Web Server Spawning Shell After Next.js RCE Exploitation

ATT&CK: T1190

Detects a Node.js/Next.js server process spawning a shell or interpreter and executing download/exfiltration commands, consistent with CVE-2025-55182 prototype-pollution RCE reaching child_process.execSync. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Node.js Server Spawning Shell Consistent With Next.js RCE
id: d729925e-da62-5efc-b215-3fb6435b3640
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - node
    - next-server
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /curl
    - /wget
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - base64
    - /etc/passwd
    - .env
    - chmod +x
  filter_build:
    CommandLine|contains:
    - npm install
    - next build
    - node_modules/.bin
  condition: selection_parent and selection_child and selection_cmd and not filter_build
falsepositives:
- CI/CD pipelines that build or deploy Next.js apps and legitimately shell out from
  node
- Custom build scripts invoking curl/wget for dependency fetching during deployment
level: high
tags:
- attack.t1190
- attack.t1059.004
- attack.t1505.003
author: Vorant
```

### Environment File Access or Exfiltration by Web Server Process

ATT&CK: T1552.001

Detects a Node.js/Next.js web server process (or its child shell) reading or transferring the .env file, matching the credential-harvesting payloads observed in CVE-2025-55182 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Dotenv File Read or Exfiltration From Node Web Process
id: bdb88d75-79cc-53d8-9e3b-ddb8505ef7b9
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - node
    - next-server
  selection_env:
    CommandLine|contains:
    - .env
  selection_action:
    Image|endswith:
    - /cat
    - /curl
    - /wget
    - /nc
    - /base64
  condition: selection_parent and selection_env and selection_action
falsepositives:
- Legitimate configuration management or deployment tooling that reads .env files
  from a node parent process
- Developer debugging scripts run under a node process manager (e.g. pm2) that cat
  local .env for troubleshooting
level: high
tags:
- attack.t1552.001
- attack.t1567.002
- attack.t1190
author: Vorant
```

### HTTP POST With Next-Action Header and Prototype Pollution Payload

ATT&CK: T1071.001

Detects inbound HTTP POST requests carrying a Next-Action header combined with prototype-pollution style payload keys (__proto__/constructor), the mechanism used to trigger CVE-2025-55182 against Next.js App Router endpoints. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Next.js Server Action Request With Prototype Pollution Indicators
id: cb541481-293d-5313-832a-2cf898a0493f
status: experimental
logsource:
  category: proxy
  product: null
detection:
  selection_method:
    cs-method: POST
  selection_header:
    cs-headers|contains: Next-Action
  selection_payload:
    cs-uri-query|contains:
    - __proto__
    - constructor.prototype
    - constructor%5Bprototype%5D
  condition: selection_method and selection_header and selection_payload
falsepositives:
- Legitimate Next.js Server Action calls that coincidentally reference constructor/prototype
  identifiers in JSON payloads (rare in normal app traffic)
level: medium
tags:
- attack.t1071.001
- attack.t1190
- attack.t1595.002
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://securitylabs.datadoghq.com/articles/cve-2025-55182-react2shell-remote-code-execution-react-server-components/

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/481764f2-ea26-4054-b3aa-b66a93163995/cve-2025-55182-is-a-critical-unauthenticated-rce-in-react-server-components.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup