Critical Next.js Vulnerability Exploited in Mass Credential Harvesting Campaign
A critical remote code execution vulnerability (CVE-2025-55182) with a perfect CVSS 10.0 score in Next.js and React Server Components allowed attackers to compromise 766 hosts worldwide. The threat actors used automated scanning tools to identify vulnerable deployments and deployed sophisticated credential harvesting frameworks to steal sensitive data including database credentials, API keys, and cloud secrets. This incident demonstrates how critical vulnerabilities in popular development frameworks can lead to widespread compromise when organizations fail to maintain current patching practices. The scale of credential theft creates significant risk for secondary attacks across victim organizations.
Tactical Insight
Immediate actions
- Update all Next.js applications to the latest patched version immediately
- Rotate all potentially compromised credentials including database passwords, API keys, and SSH keys
- Scan all internet-facing Next.js deployments for indicators of compromise
Long-term improvements
- Implement automated vulnerability scanning and patching for all web application frameworks
- Establish an inventory of all applications using Next.js and React Server Components
- Create emergency patching procedures for critical vulnerabilities in development frameworks
Detection measures
- Monitor for suspicious file uploads and script execution on web servers
- Implement network monitoring to detect unauthorized credential harvesting activities