React2Shell at Scale: 766 Next.js Servers Breached in Credential Harvest

The Vulnerability That Scores a Perfect 10

In December 2025, the React team disclosed CVE-2025-55182 — a pre-authentication remote code execution flaw in React Server Components rated CVSS 10.0, the maximum severity score. Dubbed “React2Shell” by researchers, the vulnerability stems from insecure deserialization within the Flight protocol that React Server Components use to serialize data between client and server. A single malicious HTTP request to an affected Server Function endpoint is enough to execute arbitrary code on the target machine, with no credentials required.

The flaw affects React versions 19.0 through 19.2.0 and Next.js releases across the 15.x and 16.x branches. Patches were issued on December 4, 2025 — React 19.0.1, 19.1.2, and 19.2.1, along with multiple Next.js point releases. Four months later, hundreds of production servers remain unpatched, and attackers have industrialized the exploitation pipeline.

UAT-10608 and the NEXUS Listener Framework

In April 2026, Cisco Talos published a detailed analysis of a large-scale automated credential harvesting campaign carried out by a threat cluster tracked as UAT-10608. The operation compromised at least 766 hosts across multiple geographic regions and cloud providers in a rapid, automated sweep.

The attack chain begins with automated scanning — likely leveraging host profile data from services such as Shodan or Censys to enumerate publicly reachable Next.js deployments. Once a vulnerable target is identified, the attacker sends a crafted HTTP request exploiting CVE-2025-55182 to gain remote code execution. A multi-phase dropper is then deployed, beginning with a shell script dropped into `/tmp/` with a randomized, dot-prefixed filename designed to evade casual detection.

All stolen data flows to a command-and-control server running a custom web interface called NEXUS Listener. The GUI provides the operator with pre-compiled statistics on harvested credentials and compromised hosts, turning mass exploitation into a searchable database of stolen secrets.

What the Attackers Harvest

The breadth of data exfiltrated from each compromised host is staggering. According to Talos, the dropper harvests:

• Cloud credentials: AWS access key and secret pairs, Azure subscription credentials, and cloud instance metadata (IMDS) tokens
• Payment processing keys: Stripe live secret keys capable of initiating real transactions
• AI platform tokens: API keys for OpenAI, Anthropic, NVIDIA NIM, and OpenRouter
• Source control: GitHub personal access tokens and GitLab tokens
• Infrastructure secrets: SSH private keys, Kubernetes tokens, Docker configurations, and database connection strings with cleartext passwords
• Operational intelligence: Shell command history and runtime environment variables

For organizations running Next.js applications in cloud environments, a single compromised server can expose the keys to every connected service — from payment processing to AI inference to source code repositories.

Why Four Months of Exposure Matters

The vulnerability was disclosed and patched in December 2025. The mass exploitation campaign Talos documented occurred in early 2026. This four-month gap highlights a persistent pattern in enterprise security: critical patches sit unapplied while attackers automate exploitation at scale.

Microsoft’s security blog published a defending guide on December 15, 2025. Wiz and Palo Alto Unit 42 released their own analyses. Despite widespread awareness in the security community, hundreds of production deployments remained exposed.

The indiscriminate nature of the campaign — scanning broadly rather than targeting specific organizations — means any internet-facing Next.js application running an unpatched version is a viable target regardless of its size, industry, or geography.

Detection and Remediation

Talos identifies several indicators that defenders should investigate immediately:

• Unexpected processes spawned from `/tmp/` with randomized dot-prefixed names (e.g., `/tmp/.e40e7da0c.sh`)
• `nohup` invocations in process listings not associated with known application workflows
• Unusual outbound HTTP/S connections from application containers to non-production endpoints
• Evidence of `__NEXT_DATA__` containing server-side secrets in rendered HTML

The primary remediation is straightforward: upgrade to patched versions. For Next.js, the fixed releases are 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7. For React, upgrade to 19.0.1, 19.1.2, or 19.2.1. Organizations that cannot patch immediately should implement WAF rules to block malicious serialized payloads targeting Server Function endpoints and audit all environment variables accessible to the application runtime.

Beyond patching, any organization that ran a vulnerable version should rotate all credentials that were accessible to the application’s runtime environment — including cloud keys, API tokens, database passwords, and SSH keys.

Sources & Further Reading

• UAT-10608: Inside a Large-Scale Automated Credential Harvesting Operation — Cisco Talos
• Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts — The Hacker News
• Critical Security Vulnerability in React Server Components — React
• React2Shell: Critical React Vulnerability — Wiz
• Defending Against CVE-2025-55182 — Microsoft Security Blog
• React2Shell Exploited in Large-Scale Credential Harvesting Campaign — SecurityWeek