CVE-2025-55182: Hackers Exploit React2Shell in Next.js Applications

Threat actors have initiated a widespread campaign leveraging a flaw in the React2Shell component to compromise Next.js web applications. According to BleepingComputer, this automated credential theft campaign focuses on exploiting CVE-2025-55182 to extract sensitive environment variables and authentication tokens. The CVE facilitates an RCE vector, allowing attackers to execute arbitrary code within the context of the application server, ultimately leading to the exfiltration of high-value secrets.

Next.js 14 React2Shell Vulnerability Analysis

The vulnerability stems from how the React2Shell module handles server-side rendering (SSR) inputs. When a Next.js application utilizes this component without proper input sanitization, an attacker can inject malicious payloads that gain execution privileges on the backend. Analysis of the current campaign suggests that threat actors are using mass-scanning tools to identify internet-facing Next.js instances. Once a target is identified, the exploit payload is delivered via HTTP requests designed to trigger the flaw and establish a persistent connection to a C2 server.

Unlike traditional Phishing attacks that target end-users, this campaign targets the infrastructure itself. By gaining access to the server environment, attackers can scrape .env files, which frequently contain AWS access keys, database passwords, and Stripe API secrets. This information is then funneled into automated scripts that verify the validity of the stolen credentials in real-time. The speed at which these automated tools operate makes manual response difficult for a standard SOC.

How to Detect CVE-2025-55182 Exploit Attempts

Detecting exploitation of this flaw requires visibility into application-layer traffic and server-side execution logs. Security teams should monitor for unusual outbound connections from their web servers to unrecognized IP addresses, which may indicate beaconing activity. Integrating application logs into a SIEM can help identify specific IoC patterns, such as unusual POST requests containing shell-like syntax directed at Next.js rendering endpoints.

Key detection strategies include:

• Reviewing web server logs for HTTP 500 errors occurring in conjunction with suspicious URI parameters.
• Implementing file integrity monitoring on sensitive configuration files like .env and local settings.
• Analyzing process execution trees to identify unexpected child processes spawned by the Node.js runtime.

React2Shell Credential Theft Mitigation

The primary remediation for this threat is the immediate update of the Next.js framework and the React2Shell dependency to versions containing the official security patch. If patching is not immediately feasible, organizations should consider implementing a Web Application Firewall (WAF) rule to block common RCE patterns associated with this exploit.

Beyond patching, a comprehensive React2Shell credential theft mitigation strategy must include a full secret rotation. Because the vulnerability allows for the extraction of environment variables, any secret stored on a compromised server must be considered compromised. Defenders should revoke existing API keys and generate new credentials only after the underlying vulnerability has been resolved. Furthermore, adopting a principle of least privilege for service accounts can limit the potential damage if an attacker successfully exploits a similar vulnerability in the future.