CVE-2025-55182Active Exploitation(facebook / next.js)

CRITICALCVSS 10.0 · CRITICALCISA KEV

Exploitation observed; activity peaked at 42 mentions and remains active

Immediate actions

Patch facebook next.js systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

facebook CVEs Back to dashboard

9.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-12-12. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Patch / fix

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-502

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

next.js
react

Threat summary

Active exploitation appears in 247 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
398 mentions across 133 observed days

What's happening

Active exploitation reported across 247 signals
Exploit tool or code specified in 53 signals
PoC mentioned or linked in 47 signals
Patch or workaround mentioned in 74 signals
Technical details provided in 153 signals
General: 63 classified signals
Disclosure: 32 classified signals
Peaked 81d ago at 42 mentions (2026-04-03); latest day: 1
398 total mentions across 133 days

Affected systems

Vendors

facebook vercel

Products

next.jsreact

7 versions affected across 2 products

Deep dive

Activity timeline398 mentions / 133d

Signal classification7 categories

Active Exploitation

23862.0%

General

6316.4%

Disclosure

328.3%

Patch

205.2%

Exploit

174.4%

PoC

133.4%

Referenced assets278 URLs

By indicator

Classification over time

Date	Total	Labels

2026-01-27	2	Active Exploitation2
2026-01-28	7	Active Exploitation5Disclosure1General1
2026-01-29	6	Active Exploitation3Disclosure2General1
2026-01-30	5	Active Exploitation1General1Patch2PoC1
2026-02-01	2	Active Exploitation1Disclosure1
2026-02-02	2	General2
2026-02-03	3	Active Exploitation3
2026-02-04	14	Active Exploitation11Disclosure1General2
2026-02-05	7	Active Exploitation5General2
2026-02-06	3	Active Exploitation2General1
2026-02-08	2	Active Exploitation2
2026-02-09	4	Active Exploitation3Disclosure1
2026-02-10	6	Active Exploitation2Disclosure2Exploit1Patch1
2026-02-11	4	Active Exploitation3General1
2026-02-12	4	Active Exploitation1Exploit1General2
2026-02-13	2	Active Exploitation1General1
2026-02-14	2	Active Exploitation1General1
2026-02-15	3	Active Exploitation1General2
2026-02-17	1	General1
2026-02-18	1	Active Exploitation1
2026-02-19	3	Active Exploitation2Patch1
2026-02-20	3	Active Exploitation2General1
2026-02-22	1	Active Exploitation1
2026-02-23	2	Exploit1General1
2026-02-24	2	Active Exploitation2
2026-02-25	2	Disclosure1General1
2026-02-26	1	Active Exploitation1
2026-02-27	4	Disclosure2General2
2026-03-01	1	General1
2026-03-03	4	Active Exploitation1General2Patch1
2026-03-04	2	Active Exploitation1Disclosure1
2026-03-06	2	Active Exploitation1General1
2026-03-07	1	Patch1
2026-03-08	1	Patch1
2026-03-09	7	Active Exploitation4Disclosure1General2
2026-03-10	1	Active Exploitation1
2026-03-11	2	Active Exploitation2
2026-03-12	1	General1
2026-03-13	1	Active Exploitation1
2026-03-16	1	Active Exploitation1
2026-03-17	1	Exploit1
2026-03-18	1	Patch1
2026-03-19	3	Active Exploitation2General1
2026-03-22	5	Disclosure1Exploit1General3
2026-03-24	1	Patch1
2026-03-25	1	Active Exploitation1
2026-03-26	1	General1
2026-03-27	1	Active Exploitation1
2026-03-31	2	Exploit1General1
2026-04-01	4	Active Exploitation3General1
2026-04-02	33	Active Exploitation32General1
2026-04-03	42	Active Exploitation38Exploit1False Positive1General2
2026-04-04	7	Active Exploitation7
2026-04-05	13	Active Exploitation12Disclosure1
2026-04-06	11	Active Exploitation9Disclosure1PoC1
2026-04-07	9	Active Exploitation7Disclosure1General1
2026-04-08	6	Active Exploitation4General1Patch1
2026-04-09	3	Active Exploitation2Patch1
2026-04-10	3	Active Exploitation2Disclosure1
2026-04-11	3	Disclosure1General1PoC1
2026-04-12	1	Disclosure1
2026-04-13	2	Active Exploitation1Exploit1
2026-04-14	3	Active Exploitation2Exploit1
2026-04-15	5	Active Exploitation2General1Patch1PoC1
2026-04-16	3	Active Exploitation2General1
2026-04-18	2	Disclosure1General1
2026-04-19	1	Active Exploitation1
2026-04-20	4	Active Exploitation4
2026-04-22	4	Active Exploitation3Disclosure1
2026-04-23	1	Active Exploitation1
2026-04-24	3	Active Exploitation3
2026-04-25	1	Active Exploitation1
2026-04-26	1	Active Exploitation1
2026-04-27	1	Active Exploitation1
2026-04-28	1	Active Exploitation1
2026-04-30	2	Active Exploitation1General1
2026-05-01	1	Active Exploitation1
2026-05-02	2	Active Exploitation1Patch1
2026-05-05	3	Active Exploitation2General1
2026-05-06	2	Active Exploitation1Disclosure1
2026-05-07	1	Patch1
2026-05-08	2	Active Exploitation2
2026-05-09	2	General1Patch1
2026-05-10	1	General1
2026-05-11	2	Active Exploitation1General1
2026-05-12	1	Active Exploitation1
2026-05-13	2	Active Exploitation2
2026-05-15	1	Patch1
2026-05-19	2	Disclosure1General1
2026-05-20	1	Patch1
2026-05-22	1	Active Exploitation1
2026-05-23	1	General1
2026-05-25	2	General1Patch1
2026-05-29	1	General1
2026-06-01	1	Exploit1
2026-06-02	1	General1
2026-06-03	2	Active Exploitation2
2026-06-04	3	Active Exploitation3
2026-06-19	1	Active Exploitation1
2026-06-22	1	Active Exploitation1
2026-06-29	1	PoC1
2026-06-30	1	Active Exploitation1
2026-07-02	1	Active Exploitation1
2026-07-08	2	PoC2
2026-07-12	1	PoC1
2026-07-22	1	General1
2026-07-23	1	Active Exploitation1
2026-07-24	1	Disclosure1
2026-07-26	1	Active Exploitation1
2026-07-31	1	Disclosure1
2026-08-02	1	Disclosure1
2026-08-03	2	Active Exploitation1Patch1
2026-08-07	1	Active Exploitation1
2026-08-11	1	General1
2026-08-17	2	Disclosure1PoC1
2026-08-18	2	Disclosure1Exploit1
2026-08-22	2	Active Exploitation1Patch1
2026-08-25	2	Exploit1General1
2026-08-27	1	Exploit1
2026-08-29	2	Disclosure1PoC1
2026-09-08	2	Exploit1General1
2026-09-09	2	PoC2
2026-09-11	1	Exploit1
2026-09-21	3	Disclosure2Exploit1
2026-09-22	3	General2PoC1
2026-09-23	1	General1
2026-09-30	3	Exploit1

Full discourse20 posts

yousukezan@yousukezan190d
Active Exploitation
Next.jsの重大欠陥を悪用した大規模侵害が発覚し、数百台規模のサーバーからクラウド認証情報や秘密鍵が窃取される事態となった。攻撃は自動化され広範囲に拡散している。この攻撃はCVE-2025-55182を悪用し、React Server Componentsの脆弱性からリモートコード実行を実現する。侵入後は「NEXUS Listener」と呼ばれる収集基盤を展開し、環境変数やSSH鍵、AWSやGCP、Azureの認証情報、APIキー、データベース接続情報などを自動収集する。収集データはGUI付きC2で管理され、侵害台数や取得情報が可視化される仕組みである。少なくとも766台が侵害され、Shodanなどを用いたスキャンで脆弱なNext.js環境が無差別に狙われたとみられる。取得された情報にはStripeやGitHubなどのトークンも含まれ、二次攻撃や不正アクセスの踏み台として悪用される危険が高い。対策として権限最小化や認証情報のローテーションが求められる。 https://thehackernews.com/2026/04/hackers-exploit-cve-2025-55182-to.html
Post summary
CVE‑2025‑55182 is actively exploited in an automated large‑scale breach, allowing attackers to execute code and harvest credentials from hundreds of Next.js/React Server Components deployments.
316017681463100.9K
14.3K followersView on X
VLadimiR@Dz10Chiheb242d
Disclosure
CVE-2025-55182 RCE on Next.js 16.0.6 #CVE https://t.co/9lf4cj6Mwj
Post summary
A new CVE (CVE-2025-55182) is announced, revealing a remote code execution flaw in Next.js version 16.0.6.
854861932789.7K
431 followersView on X
︎︎🐸いまいまい🐌@imaimai17468183d
Patch
2026年4月8日、React Server Components に新たな脆弱性（CVE-2026-23869）が公開されました。CVSS スコアは 7.5 で、深刻度は高に分類されます。何が起きたか Next.js の App Router が使用する React Server Components の処理に欠陥があります。攻撃者が細工した HTTP リクエストを App Router の Server Function エンドポイントに送信すると、デシリアライズ時にサーバーの CPU 使用率が異常に上昇し、サービスが停止する可能性があります。認証は不要で、外部から攻撃を行うことができます。対象は Next.js 13.x、14.x、15.x、16.x で App Router を使用しているアプリケーションです。Pages Router のみを使用している場合は影響を受けません。 2025年末の脆弱性との違い 2025年12月に公開された CVE-2025-55182（通称 React2Shell）は、同じ React Server Components の仕組みを悪用するものでしたが、サーバー上で任意のコードを実行できる脆弱性でした。深刻度は最高値の CVSS 10.0 で、実際に悪用された事例も報告されています。今回の CVE-2026-23869 はコードの実行には至らず、サービスの停止にとどまります。根本的な原因は同じデシリアライズ処理の設計にあり、React2Shell 以降も研究者による調査が続いた結果、関連する欠陥が順次発見されています。対応すること Next.js を以下のバージョンに更新してください。15 系を使用している場合は 15.5.15 以降、16 系を使用している場合は 16.2.3 以降が修正済みのバージョンです。Vercel にホストしている場合は WAF による緩和措置が自動適用されていますが、バージョンアップの代替にはなりません。更新後は動作確認を行い、問題がなければ本番環境に適用してください。
Post summary
CVE-2026-23869 is a high‑severity denial‑of‑service flaw in Next.js React Server Components; the notice offers technical details and explicit patch guidance but no PoC or active exploitation evidence.
21011755432491.1K
5.9K followersView on X
NullSecurityX@NullSecurityX182d
Disclosure
This vulnerability allows RCE in React Server Functions, e.g. as offered by Next.js through insecure prototype references. CVE-2025-55182 https://t.co/bnw2BQIcMA
Post summary
The tweet announces that CVE‑2025‑55182 enables remote code execution via insecure prototype references in React Server Functions, specifically impacting Next.js implementations.
128022210813.2K
12.1K followersView on X
Koupon@Shabosec43d
Exploit
I DID IT AGAIN RCE LEAD TO ADMIN PAYMENT PORTAL🔥🔥🔥 Next.js will you marry me ❤️❤️ ❤️ Tips: I found the embedded link in the js which i input which turn on Notifications it’s Vulnerable to RCE Next.js RSC Exploit Tool (CVE-2025-55182) https://github.com/ynsmroztas/NextRce Yandex Dork🔥 https://t.co/q6waergibP
Post summary
The user claims to have exploited CVE‑2025‑55182 via an RCE in Next.js, shares a GitHub-based exploit tool, and reports gaining admin access to a payment portal.
615214413212.3K
1.8K followersView on X
Renzon@r3nzsec170d
Active Exploitation
I worked with @svch0st and @TheDFIRReport to put out a report in less than 24 hours. This is especially timely given the threat actor's use of OpenClaw and Claude in the mass exploitation of CVE-2025-55182 (React2Shell). An exposed open directory gave us the full operational footprint: scanner harness, AI-orchestrated post-exploitation, Telegram C2, and thousands of exfiltrated .env files across 900+ confirmed compromises. #Claude #OpenClaw #DFIR
Post summary
The post reports that threat actors are actively exploiting CVE‑2025‑55182, using AI‑driven tools to post‑exploit, exfiltrating .env files from over 900 compromised systems.
52611064318.8K
4.4K followersView on X
termireum@termireum153d
General
CVE-2025-55182 React2Shell #bugbounty https://t.co/PMXTwyIivb
Post summary
The tweet merely lists CVE-2025-55182 with a #bugbounty hashtag and a link, providing no substantive technical or operational details.
34182345.4K
756 followersView on X
The DFIR Report@TheDFIRReport141d
Active Exploitation
We identified a large-scale React2Shell (CVE-2025-55182) operation that scanned millions of targets and confirmed 900+ successful exploits. Logs showed an automated pipeline for exploitation, hit scoring, alerting, and secret harvesting. Claude Code and OpenClaw were used as an operator-side harness supporting exploitation activity and workflow orchestration. Read the full case: https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/
Post summary
The article reports a large‑scale, ongoing exploitation campaign against CVE‑2025‑55182 using automated tools, with over 900 successful attacks.
322056348.4K
68.0K followersView on X
GreyNoise@GreyNoiseIO248d
Active Exploitation
Two IPs now generate 56% of all CVE-2025-55182 exploitation traffic. One deploys cryptominers. The other opens reverse shells. We dug into the infrastructure. What we found goes back to 2020. https://www.greynoise.io/blog/react2shell-exploitation-consolidates
Post summary
Two IP addresses dominate the exploitation traffic for CVE‑2025‑55182, deploying cryptominers and establishing reverse shells, demonstrating active exploitation in the wild.
012259347.4K
29.3K followersView on X
X@SansLimit3205d
Active Exploitation
Exploitation infrastructure observed scanning for: CVE-2025-55182(React2shell) CVE-2026-21962(Oracle Weblogic) CVE-2025-31324(SAP NetWeaver) - actively exploited by China-linked APTs Targeting India-based critical infrastructure SAP exploit script "MADE BY SCATTERED LAPSUS$ HUNTERS" → likely tool reuse. Tooling includes fscan & Neo-reGeorg - commonly seen in China-linked intrusion tradecraft. C2s: 160[.]191.183.147:80 160[.]191.183.126:80 Seen on @Huntio ~ 1 month ago. @malwrhunterteam @polygonben @WhichbufferArda
Post summary
The report details scanning activity for several CVEs, noting that CVE-2025-31324 in SAP NetWeaver is actively exploited by China‑linked APTs, and references a known exploit script, but provides no patch info or in‑depth vulnerability specifics.
27154244.6K
231 followersView on X
Ctrl-Alt-Intel@ctrlaltintel157d
Active Exploitation
Recent find by our team using @Huntio🕵️‍♂️ Akia: Exploiting CVE-2025-55182/66478, this French Claude-coded pipeline is a massive secret harvester: 🔹13 Git/8 SMTP APIs 🔹3k+ AWS Keys 🔹250M JS URLs 🔹EVM/BTC/SOL 🔹250+ ENV types 🔹1k+ Cloud paths 🔹300+ Configs 🔹20+ Code exts https://t.co/U1lTYkltHR
Post summary
The tweet reports that a research team is actively exploiting CVE‑2025‑55182/66478 to harvest credentials and code from compromised systems.
011150246.9K
969 followersView on X
Unit 42@Unit42_Intel182d
Active Exploitation
React2Shell (CVE-2025-55182) was exploited within 2 days of public disclosure. Attackers executed commands in Kubernetes workloads, installing backdoors and stealing data. Application exploits lead to cluster compromise. Read our analysis: https://bit.ly/3Q4x50q https://t.co/g9y4qKI3s6
Post summary
CVE‑2025‑55182 was actively exploited within two days of its disclosure, enabling attackers to run arbitrary commands inside Kubernetes workloads, install backdoors, and steal data, posing a serious risk to containerized environments.
117246207.0K
69.4K followersView on X
blackorbird@blackorbird129d
Active Exploitation
Analysis of #Lazarus Campaign Exploiting CVE-2025-55182 and Copperhedge Malware This report analyzes an ongoing intrusion campaign launched by the notorious Lazarus Group, leveraging the high-risk unauthenticated remote code execution (RCE) vulnerability CVE-2025-55182 paired with the Copperhedge malware suite, targeting global financial institutions and blockchain infrastructure for financial theft and sensitive intelligence harvesting. https://mp.weixin.qq.com/s/3kwDMAXviaE1TUDnkYlqrg
Post summary
The report highlights an active Lazarus intrusion campaign exploiting CVE‑2025‑55182 via Copperhedge malware against financial institutions, confirming real‑world exploitation of the RCE vulnerability.
016039193.3K
42.9K followersView on X
andrew gao@itsandrewgao212d
General
remember the react2shell CVE from dec '25? so apparently the guy found it using deepwiki... (CVE-2025-55182) https://t.co/LXEbSP52LV
Post summary
The tweet merely references CVE-2025-55182 and notes its discovery via deepwiki, providing no further technical or operational details.
3204895.9K
43.7K followersView on X
Aircorridor@_aircorridor178d
Active Exploitation
React2Shell (CVE-2025-55182) is already being actively exploited against Next.js systems worldwide. Don’t just hear about it, understand it: https://hackers-arise.com/react2shell-vulnerability-exploited-to-build-massive-iot-botnet/ @three_cube @DI0256 @IamSmouk @co11ateral https://t.co/cnEKn1Fb1c
Post summary
The tweet confirms that CVE-2025-55182 (React2Shell) is being actively exploited in the wild, with a link pointing to a blog post discussing the exploitation.
08021131.7K
13.1K followersView on X
Hunt.io@Huntio185d
Active Exploitation
🚨 React2Shell Exploitation at Scale: 700+ Systems Breached in Global Campaign https://www.darkreading.com/cyberattacks-data-breaches/automated-credential-harvesting-campaign-react2shell A large-scale campaign is exploiting React2Shell (CVE-2025-55182) to compromise exposed Next.js apps and harvest credentials at scale. At least 766 systems across industries and cloud providers have been hit. Once inside, attackers deploy an automated framework to extract SSH keys, tokens, and secrets, turning breaches into searchable datasets. With automated scanning and zero auth required, the scope is extensive, and the stolen credentials can quickly be used to launch additional attacks. #ThreatIntelligence #ThreatHunting #CyberSecurity
Post summary
The report details a worldwide exploitation campaign against the CVE-2025‑55182 React2Shell vulnerability, impacting more than 766 Next.js applications and leading to large‑scale credential theft.
07024102.2K
6.3K followersView on X
Is Now on VT!@Now_on_VT237d
Active Exploitation
Sample is now on VT! 🚩Hash: ba43e447e63611d365300bf2e8e43ccb02ea112778d0d555ef9a9ccf6169808b 🎯Malware name: Multiple:React2shell 🔹Comment: Analysis of React Server Components RCE vulnerability (CVE-2025-55182) exploitation leading to cryptojacking campaigns targeting Next.JS applications. 🌐URL: https://tlpblack.net/blog/20251209-the-anatomy-of-a-react2shell-compromise 🔎OnVT: https://www.virustotal.com/gui/file/ba43e447e63611d365300bf2e8e43ccb02ea112778d0d555ef9a9ccf6169808b
Post summary
The post confirms that CVE-2025-55182 is being actively exploited for cryptojacking against Next.JS applications, but no exploit code or patch is provided.
2402473.0K
4.2K followersView on X
Marcel Velica@MarcelVelica165d
Active Exploitation
900+ companies hacked. One vulnerability. One automated pipeline. Hackers are using AI + Telegram bots to exploit React2Shell (CVE-2025-55182) at scale stealing credentials, cloud access, and financial data in minutes. This isn’t random hacking. It’s organized, automated, and fast. If you’re not patching in real time, you’re already behind. Are you confident your systems would survive this attack? #CyberSecurity #Infosec #AI #DataBreach
Post summary
The message claims CVE‑2025‑55182 is being actively exploited by attackers using AI‑driven Telegram bots, compromising over 900 companies and underscoring the urgency of real‑time patching.
22028237.3K
23.0K followersView on X
yousukezan@yousukezan202d
Exploit
【React2Shell】CVE-2025-55182 — あなたのNext.jsは今も狙われている https://qiita.com/barshige-sec/items/d49f595c7b646d60aed3 #Qiita @barshigeより
Post summary
The post reports on CVE-2025-55182 in Next.js, presents a working React2Shell PoC, claims the vulnerability is still actively exploited, and offers no patch or mitigation details.
01019102.2K
12.1K followersView on X
Clandestine@akaclandestine131d
Exploit
GitHub - Jenderal92/CVE-2025-55182-React2shell: CVE-2025-55182 Exploit Tool – Python 2.7 exploit for Next.js prototype pollution leading to RCE · GitHub https://github.com/Jenderal92/CVE-2025-55182-React2shell
Post summary
The GitHub repository hosts a Python 2.7 exploit for Next.js prototype pollution (CVE-2025-55182) that leads to remote code execution, providing functional exploitation code but no evidence of active attacks or patches.
0501682.0K
62.5K followersView on X

CPE platform detail76 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

76 of 76 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	facebook	react	19.0.0	-	-
App	facebook	react	19.1.0	-	-
App	facebook	react	19.1.1	-	-
App	facebook	react	19.2.0	-	-
App	vercel	next.js	-	node.js	-
App	vercel	next.js	14.3.0	node.js	-
App	vercel	next.js	14.3.0	node.js	-
App	vercel	next.js	14.3.0	node.js	-
App	vercel	next.js	14.3.0	node.js	-
App	vercel	next.js	14.3.0	node.js	-
App	vercel	next.js	14.3.0	node.js	-
App	vercel	next.js	14.3.0	node.js	-
App	vercel	next.js	14.3.0	node.js	-
App	vercel	next.js	14.3.0	node.js	-
App	vercel	next.js	14.3.0	node.js	-
App	vercel	next.js	14.3.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	15.6.0	node.js	-
App	vercel	next.js	16.0.0	node.js	-

Explore more

Back to dashboard facebook CVEs vercel CVEs next.js vulnerabilities

What researchers are saying

CVE-2025-55182

yousukezan[verified]@yousukezanActive Exploitation

CVE‑2025‑55182 is actively exploited in an automated large‑scale breach, allowing attackers to execute code and harvest credentials from hundreds of Next.js/React Server Components deployments.

︎︎🐸いまいまい🐌[verified]@imaimai17468Patch

CVE-2026-23869 is a high‑severity denial‑of‑service flaw in Next.js React Server Components; the notice offers technical details and explicit patch guidance but no PoC or active exploitation evidence.

NullSecurityX[verified]@NullSecurityXDisclosure

The tweet announces that CVE‑2025‑55182 enables remote code execution via insecure prototype references in React Server Functions, specifically impacting Next.js implementations.

Renzon[verified]@r3nzsecActive Exploitation

The post reports that threat actors are actively exploiting CVE‑2025‑55182, using AI‑driven tools to post‑exploit, exfiltrating .env files from over 900 compromised systems.

The DFIR Report[verified]@TheDFIRReportActive Exploitation

The article reports a large‑scale, ongoing exploitation campaign against CVE‑2025‑55182 using automated tools, with over 900 successful attacks.

GreyNoise[verified]@GreyNoiseIOActive Exploitation

Two IP addresses dominate the exploitation traffic for CVE‑2025‑55182, deploying cryptominers and establishing reverse shells, demonstrating active exploitation in the wild.

X[verified]@SansLimit3Active Exploitation

The report details scanning activity for several CVEs, noting that CVE-2025-31324 in SAP NetWeaver is actively exploited by China‑linked APTs, and references a known exploit script, but provides no patch info or in‑depth vulnerability specifics.

blackorbird[verified]@blackorbirdActive Exploitation

The report highlights an active Lazarus intrusion campaign exploiting CVE‑2025‑55182 via Copperhedge malware against financial institutions, confirming real‑world exploitation of the RCE vulnerability.