Notifications
Clear all
Topic starter
20/08/2026 5:42 pm
TL;DR: CVE-2025-55182 is being actively exploited across React Server and Next.js applications, with proof-of-concepts appearing within days and an estimated 60,000 vulnerable servers exposed to the public internet, according to Expel. The pattern turns patching, ingress log hunting, and asset discovery into immediate priorities because atomic indicators are already losing value.
NHIMG editorial — based on content published by Expel: CVE-2025-55182 exploitation guidance for React Server and Next.js applications
Questions worth separating out
Q: What breaks when a server-side framework vulnerability is not patched quickly?
A: The main failure is that the application runtime becomes the attacker’s execution path before defenders can separate legitimate from malicious requests.
Q: Why do old application frameworks increase identity and secrets risk?
A: Old frameworks often survive alongside old deployment patterns, long-lived API keys, and fragile CI/CD secrets.
Q: How do security teams know if exploitation is happening in ingress traffic?
A: Look for request patterns that match internal framework behaviour rather than normal client traffic.
Practitioner guidance
- Patch exposed React Server and Next.js instances first Prioritise internet-facing systems, then audit less common applications and embedded implementations that use the same framework components.
- Scan cloud and on-prem estates for vulnerable framework usage Use vulnerability scanners across hosted and on-prem environments to identify applications running React Server or Next.js, including shadow deployments and inherited dependencies that are not obvious from the primary application inventory.
- Create ingress detections for protocol misuse Alert on suspicious headers such as next-action and Rsc-action-id, and on payload patterns including $@, resolved_model, then with function constructors, and serialized command references in request bodies.
What's in the full analysis
Expel's full analysis covers the operational detail this post intentionally leaves for the source:
- Specific ingress log examples that show how the exploit appears in real traffic patterns
- The vendor's guidance on identifying less common React Server and Next.js implementations across environments
- Notes on how scanners and monitoring were used to track exposure and remediation status
- Reference links to additional third-party deep dives and live tracking resources
👉 Read Expel's analysis of CVE-2025-55182 exploitation in React Server apps →
React Server and Next.js exploitation risk: are your controls keeping up?
Explore further
20/08/2026 6:26 pm
Runtime exploitation in application frameworks is now an identity-adjacent risk because the first trusted boundary is often the process that holds secrets. When attacker code runs inside the same runtime as the application, the real question becomes what identities, tokens, and internal services that process can reach. That shifts the governance discussion from application patching alone to blast-radius control across secrets, service accounts, and workload permissions.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Who is accountable when a vulnerable application framework is exposed to the internet?
A: Accountability usually spans engineering, platform, and security operations. Engineering owns patching and release validation, platform teams manage exposure and deployment controls, and security teams verify risk acceptance only after reachability, version state, and monitoring are all confirmed.
👉 Read our full editorial: CVE-2025-55182 exposure in React Server apps raises patch urgency
