Two newly disclosed CVEs—CVE-2025-55182 in React Server Components and CVE-2025-29927 in Next.js middleware—open a path for remote-code execution and authentication bypass on modern JavaScript stacks. A single request can trigger the flaws; configuration alone cannot stop them. Teams that rely on React Server Components or Next.js middleware must treat these bugs as urgent and push patches immediately.

Why the noise in the logs is misleading

We pulled a month of edge logs from a production Next.js site. The set contained 8,900 requests flagged as malicious. Almost every one failed on the first hop. The most common URL was /wp-admin/install.php, hit 518 times, even though the site does not run WordPress, does not use PHP, and has no WordPress files.

Automated scanners generate this traffic. They spray the internet with guesses, hunting for:

  • Secrets and configuration files – 64 % of attempts
  • PHP panels and shells – 22 %
  • WordPress paths – 11 %
  • Database tools – 1 %

A high count of blocked requests only tells you that you are not running the software the bots expect. It does not guarantee that the application you are running is safe.

The quiet, framework-level attacks

When an attacker targets a Next.js app, the traffic looks like ordinary user requests, using the framework’s own mechanisms against it.

React2Shell (CVE-2025-55182)

A flaw in React Server Components lets an attacker inject a specially crafted payload that the server evaluates as code. The result is full remote-code execution without needing to bypass a firewall or web-application filter. The vulnerability lives inside the framework; the only remedy is to upgrade to a version that contains the fix.

Middleware Authorization Bypass (CVE-2025-29927)

Next.js middleware can enforce security checks based on request headers. This CVE shows that an attacker can supply a particular internal header and cause the middleware to skip those checks entirely. From the outside the request looks ordinary, making detection difficult.

Both bugs show that the most dangerous traffic can blend in with everyday traffic, evading the alarms that catch noisy WordPress probes.

What the stakes are

  • Developers who treat framework updates as optional risk a complete takeover of their servers.
  • Operations teams that rely on static configuration to harden a stack cannot protect against code that runs inside the framework itself.

A practical defence checklist

  1. Deployment hygiene – Do not ship secrets in files such as .env. Store them in environment variables supplied at runtime or in a dedicated secret-management system.
  2. Minimal attack surface – Turn off framework features you do not use. Enforce a strict Content-Security-Policy that blocks loading of unauthorized scripts.
  3. Rapid patching – Automate the build pipeline so a new framework version can be tested and deployed within hours of release. Treat security updates as a regular part of the release cadence, not an after-thought.

What to watch next

  • Subscribe to the official security advisory feeds for React, Next.js, and any other runtime libraries you depend on.
  • Integrate vulnerability scanners that understand JavaScript package metadata, so a newly published CVE triggers an automatic alert.
  • Build a rollback-ready deployment pipeline; if a patch introduces regressions, you can revert quickly without leaving the system exposed.

The lesson is clear: the loudest attacks in your logs are often misdirection. The real danger hides in the framework your code trusts. Keep the stack lean, store secrets safely, and treat patches as routine, and you turn quiet, framework-level threats into manageable risks.