Notifications
Clear all
Topic starter
02/08/2026 12:13 pm
TL;DR: CVE-2025-55182 and related CVE-2025-66478 in Next.js can allow unauthenticated remote code execution through a crafted HTTP request against React Server Components, putting server-side code, data, and credentials at risk according to Cymulate. The vulnerability shows how application-layer trust collapses when exposed frameworks, dependency chains, and patch drift are not tightly governed.
NHIMG editorial — based on content published by Cymulate: Critical RCE in React Server Components CVE-2025-55182 and CVE-2025-66478
By the numbers:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface
Questions worth separating out
Q: What breaks when an internet-facing application has unauthenticated remote code execution?
A: When an internet-facing application has unauthenticated remote code execution, the first broken control is trust at the perimeter.
Q: Why do exposed web applications become identity security problems so quickly?
A: Because application servers often sit on top of valuable non-human identities.
Q: What do security teams get wrong about patching SAP vulnerabilities?
A: They often treat patching as an infrastructure task instead of a control-state change.
Practitioner guidance
- Inventory every exposed React and Next.js workload Identify all public-facing and internal applications that use React 19, Next.js App Router, or bundled react-server-dom modules.
- Validate secret exposure paths from the application host Map which API keys, tokens, environment variables, and service accounts are reachable if the server is compromised.
- Rebuild trust in the release pipeline Compare lock files, build outputs, and package manager behaviour to detect dependency drift.
What's in the full report
Cymulate's full analysis covers the operational detail this post intentionally leaves for the source:
- Exact vulnerable React and Next.js version ranges, including affected react-server-dom module combinations.
- The scanner and attack-simulation behaviour used to validate WAF, SIEM, and endpoint detection coverage.
- Recommended patch sequencing for react-server-dom-* packages and Next.js releases in mixed environments.
- Guidance on using exposure validation in BAS or red-team exercises to confirm containment before exploitation.
👉 Read Cymulate's analysis of the React Server Components RCE and exposure testing →
React Server Components RCE: are your web app controls ready?
Explore further
02/08/2026 1:16 pm
Application RCE is now an identity exposure event: When a web framework flaw can expose secrets and service credentials, patching alone is only the first control layer. The real governance question is which non-human identities, tokens, and deployment accounts become reachable after server compromise. That shifts the issue from application hygiene to blast-radius management, especially in cloud-hosted environments where one compromised node can unlock many systems.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: Which controls matter most after a public application RCE is disclosed?
A: Containment starts with patching, but the bigger control set is identity and secrets hygiene. Rotate exposed credentials, review service account permissions, remove persistent secrets from app hosts, and check for anomalous outbound activity from affected servers. Those steps reduce the chance that one exploit becomes a broader cloud or data breach.
👉 Read our full editorial: React Server Components RCE exposes the limits of app-layer trust
