Next.js React Server Components critical RCE flaw
CVE-2025-55182 is a critical unauthenticated RCE in React Server Components affecting Next.js, with public exploits and active mass scanning observed since December 3, 2024.
Sourcesecuritylabs.datadoghq.com — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-55182 as exploited in the wild.
On December 3, 2024, a remote code execution vulnerability (CVE-2025-55182) was disclosed in React Server Components, affecting the popular Next.js framework when using the App Router feature. The vulnerability is a server-side prototype pollution issue that allows unauthenticated attackers to execute arbitrary commands on affected servers. Next.js tracks this as CVE-2025-66478 and has released patches for versions 15.x and 16.x. Public proof-of-concept code emerged within 24 hours, with the first working exploit published by security researcher Moritz Sanft on December 4. Datadog researchers confirmed exploitation is trivial, including against default applications created by create-next-app scaffolding.
Active exploitation began within hours of disclosure, with Datadog telemetry identifying over 800 IP addresses conducting scanning and exploitation attempts as of December 5. Initial scanning used non-functional payloads, but shifted to weaponized exploits once working PoCs became available. Observed malicious payloads include .env file exfiltration, cryptocurrency miner deployment, botnet recruitment scripts, and persistence mechanisms including web shell injection. The vulnerability requires only HTTP POST requests with specially crafted JSON payloads to the Next-Action header, making exploitation straightforward for threat actors.
Organizations running Next.js versions 15.x, 16.x, or 14.3.0-canary.77 and later should immediately upgrade to patched releases (15.0.5+, 15.1.9+, 15.2.6+, 15.3.6+, 15.4.8+, 15.5.7+, or 16.0.7+). The server-side prototype pollution technique exploits JavaScript's prototype chain to inject malicious properties into spawned processes, particularly targeting child_process.execSync calls. This vulnerability represents a significant threat to the JavaScript server-side ecosystem given Next.js's widespread adoption.
Mentioned in this report
Detection guidance
Node.js Web Server Spawning Shell After Next.js RCE Exploitation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Node.js/Next.js server process spawning a shell or interpreter and executing download/exfiltration commands, consistent with CVE-2025-55182 prototype-pollution RCE reaching child_process.execSync. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Server Spawning Shell Consistent With Next.js RCE
id: d729925e-da62-5efc-b215-3fb6435b3640
status: experimental
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- node
- next-server
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /curl
- /wget
selection_cmd:
CommandLine|contains:
- curl
- wget
- base64
- /etc/passwd
- .env
- chmod +x
filter_build:
CommandLine|contains:
- npm install
- next build
- node_modules/.bin
condition: selection_parent and selection_child and selection_cmd and not filter_build
falsepositives:
- CI/CD pipelines that build or deploy Next.js apps and legitimately shell out from
node
- Custom build scripts invoking curl/wget for dependency fetching during deployment
level: high
tags:
- attack.t1190
- attack.t1059.004
- attack.t1505.003
author: Vorant
Environment File Access or Exfiltration by Web Server Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Node.js/Next.js web server process (or its child shell) reading or transferring the .env file, matching the credential-harvesting payloads observed in CVE-2025-55182 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Dotenv File Read or Exfiltration From Node Web Process
id: bdb88d75-79cc-53d8-9e3b-ddb8505ef7b9
status: experimental
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- node
- next-server
selection_env:
CommandLine|contains:
- .env
selection_action:
Image|endswith:
- /cat
- /curl
- /wget
- /nc
- /base64
condition: selection_parent and selection_env and selection_action
falsepositives:
- Legitimate configuration management or deployment tooling that reads .env files
from a node parent process
- Developer debugging scripts run under a node process manager (e.g. pm2) that cat
local .env for troubleshooting
level: high
tags:
- attack.t1552.001
- attack.t1567.002
- attack.t1190
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://securitylabs.datadoghq.com/articles/cve-2025-55182-react2shell-remote-code-execution-react-server-components/
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs