Next.js, React and Node.js stack breach guide
Published 4 Nov 2026 · Updated 2026-11-04
If your website is built with Next.js, check that it is on a patched release for CVE-2025-55182 (React2Shell), a remote code execution flaw in React Server Components that CISA lists as exploited, and for CVE-2025-29927 if you rely on middleware for login checks. Keep the Node.js runtime on a supported LTS line, or confirm your host does.
Who this is for: Australian start-ups, retailers and service businesses whose website or customer portal is built with Next.js or another React framework, often by a small in-house team or agency. Written by our collective of Melbourne web and app developers; facts checked against NVD, the CISA KEV catalog and vendor advisories on 2026-11-04. Free to use and share.
Book a free stack check Already breached? First steps
Supported versions
Next.js (React)
Next.js supports the current major release, and the previous major gets security fixes for a limited period under its published support policy. Sites built with the App Router also depend on React Server Components packages, so React and Next.js updates need to be applied together.
| Branch | Active support | Security support until |
|---|---|---|
| Current major | Supported | Supported |
| Previous major | — | Per the Next.js support policy |
| Older majors | — | Unsupported |
Source: Next.js (React) official lifecycle (checked 2026-11-04).
Node.js
| Branch | Active support | Security support until |
|---|---|---|
| 20 and older | — | End of life (20.x ended 2026-04-30) |
| 22 (Jod, LTS) | Maintenance since 2025-10-21 | 2027-04-30 |
| 24 (Krypton, LTS) | Maintenance since 2026-10-20 | 2028-04-30 |
| 25 | — | End of life (2026-06-01) |
| 26 (Lithium, LTS) | 2027-10-20 | 2029-04-30 |
Source: Node.js official lifecycle (checked 2026-11-04).
React2Shell: CVE-2025-55182 in React Server Components
What the issue is
React Server Components versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0 unsafely deserialise data sent to Server Function endpoints, which allows unauthenticated remote code execution. Next.js App Router apps on 15.x and 16.x bundle these packages.
Why it matters
CISA added CVE-2025-55182 to its Known Exploited Vulnerabilities catalog on 5 December 2025. Code execution on the server exposes environment variables, API keys and any customer data the app can reach.
How to fix it
- Check the next, react and react-dom versions in your lockfile.
- Upgrade Next.js to a fixed release for your line (for example 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 or later) and React to 19.0.1, 19.1.2, 19.2.1 or later.
- Rebuild and redeploy; a dependency update does nothing until the new build is live.
- If the site was unpatched after early December 2025, rotate secrets and review server logs.
- Turn on automated dependency alerts so the next fix lands quickly.
Sources: NVD: CVE-2025-55182 · Next.js security advisory · CISA KEV catalog
Middleware authorisation bypass: CVE-2025-29927
What the issue is
In Next.js before 12.3.5, 13.5.9, 14.2.25 and 15.2.3, a request carrying an internal header can skip middleware. If your app checks logins or roles only in middleware, protected pages may be reachable.
Why it matters
Customer portals, admin dashboards and preview pages often rely on middleware for access control, so a bypass can expose personal information without any password.
How to fix it
- Upgrade Next.js to 12.3.5, 13.5.9, 14.2.25, 15.2.3 or a later supported release.
- If you cannot upgrade immediately, strip the x-middleware-subrequest header at your CDN or proxy.
- Check access again inside server routes and data fetching, not only in middleware.
- Test protected pages after deploying.
Sources: NVD: CVE-2025-29927 · Next.js GitHub advisory
Running Nuxt or Vue instead of Next.js or React?
What the issue is
Nuxt (built on Vue) is a different framework from Next.js (built on React). The two Next.js/React CVEs on this page (CVE-2025-55182 and CVE-2025-29927) are specific to React Server Components and Next.js middleware and do not apply to Nuxt or Vue sites.
Why it matters
Nuxt and Vue have their own, separate security advisories. Statically generated Nuxt sites (for example hosted on S3/CloudFront) have a small server-side attack surface, so the bigger risks are usually outdated dependencies, third-party scripts and security headers.
How to fix it
- Check the Nuxt and Vue versions in package.json and keep them on a supported release.
- Review the Nuxt GitHub security advisories for your version; do not assume a Next.js CVE applies.
- Follow the Vue security guide, especially around v-html and user-supplied content.
- Audit dependencies regularly (npm audit) and keep HSTS and a Content-Security-Policy in place.
Sources: Nuxt security advisories (GitHub) · Vue.js security best practices
Key high and critical CVEs for this stack
These are recent high or critical vulnerabilities. "KEV" means CISA lists it as known to be exploited in the wild.
| CVE | Component | Affected | Fixed in | CVSS | KEV |
|---|---|---|---|---|---|
| CVE-2025-55182 | Next.js (React): Pre-authentication remote code execution in React Server Components ("React2Shell"), reachable through Next.js App Router apps | React Server Components 19.0.0, 19.1.0, 19.1.1 and 19.2.0 (react-server-dom-webpack, -turbopack, -parcel), as bundled by affected Next.js 15.x and 16.x releases | React 19.0.1, 19.1.2, 19.2.1; Next.js 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 or later | 10.0 (CVSS 3.1) | Yes (added 2025-12-05) |
| CVE-2025-29927 | Next.js (React): Authorisation bypass when access checks run in Next.js middleware (x-middleware-subrequest header) | 1.11.4 up to (not including) 12.3.5, 13.5.9, 14.2.25 and 15.2.3 | 12.3.5, 13.5.9, 14.2.25, 15.2.3 | 9.1 (CVSS 3.1, GitHub) | Not listed |
| CVE-2026-111497 | Node.js: Brotli decoder out-of-bounds write (bundled Brotli) that may allow remote code execution via a crafted compressed stream | Node.js before 22.23.4, 24.x before 24.22.1, 25.x/26.x before 26.12.1 (and Google Brotli 1.0.3–1.2.0) | 22.23.4, 24.22.1, 26.12.1 | 9.8 (CVSS 3.1, NVD); rated High by Node.js | Yes (added 2026-10-27) |
| CVE-2024-27980 | Node.js: Windows: batch-file argument handling in child_process.spawn allows command injection even without shell option | Node.js on Windows before the April 2024 security releases | April 2024 security releases (those release lines are now end of life; use a supported line) | 8.1 (CVSS 3.0, HackerOne) | Not listed |
How attacks on this stack typically work
- Attackers mass-scanned for React Server Components endpoints within days of the React2Shell disclosure.
- Apps that only check logins in middleware may let a crafted request reach protected pages on unpatched versions.
- Leaked API keys in environment variables or client bundles let attackers reach payment, email or customer databases.
- Outdated npm dependencies are a common way in, because a JavaScript app pulls in hundreds of packages.
Patch and hardening steps
- Find your exact versions. Ask your developers for the next, react and react-dom versions in package.json and the lockfile, and the Node.js version used in production. The page source usually shows that Next.js is used (/_next/static/ paths) but not which version. For Node.js run node --version or check your host settings.
- Back up first (files and database), and keep the backup off the server.
- Update Next.js (React) to at least: React 19.0.1, 19.1.2, 19.2.1; Next.js 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 or later; 12.3.5, 13.5.9, 14.2.25, 15.2.3. Move off any end-of-life branch.
- Update Node.js to at least: 22.23.4, 24.22.1, 26.12.1; April 2024 security releases (those release lines are now end of life; use a supported line). Move off any end-of-life branch.
- Remove unused plugins, apps, themes and accounts, and turn on automatic updates for minor and security releases where available.
- Lock down admin: Turn on multi-factor authentication for your hosting, Git and CMS accounts, rotate secrets stored in environment variables after any security incident, and enable dependency alerts (Dependabot or similar) on the repository.
- Check for signs of compromise after patching a KEV-listed flaw: unknown admin users, unexpected new files on the server, changed checkout or header scripts.
- Follow a patching cadence. The ACSC's Essential Eight treats patching applications as a core mitigation.
What this means for your industry
Healthcare clinics, allied health, legal and accounting practices often run a CMS such as WordPress or Silverstripe for bookings and enquiry forms, which collect sensitive personal information. A compromise can become a notifiable data breach: see data breach help for Australian businesses. Industry-specific guides are coming.
Melbourne or Victorian public-sector supplier? See Melbourne and Victorian breach contacts. We will cover reported incidents involving these technologies in our Australian breach news.
Want a second pair of eyes on your stack?
Book a short call and one of our developers will talk through your versions and patch plan. No pressure, no scare tactics.
Frequently asked questions
Is our Next.js site affected by React2Shell?
NVD lists React Server Components 19.0.0, 19.1.0, 19.1.1 and 19.2.0 as affected, and the Next.js team published fixed releases for 15.x and 16.x App Router apps. Sites that only use the Pages Router or are fully static are less exposed, but you should still confirm versions. Source
What is the Next.js middleware bypass?
CVE-2025-29927 lets a request skip middleware where authorisation checks are made. It is fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3. Source
Our site is hosted on Vercel or another platform. Are we covered?
Hosting platforms can add firewall rules, but the vulnerable code lives in your application's dependencies. You still need to update Next.js and React and redeploy. Source
I think our site was compromised. What first?
Contain it, keep logs, rotate secrets and keys, report to the ACSC and assess whether the Notifiable Data Breaches scheme applies. Source
Related stack guides
- Drupal and PHP stack breach guide
- Adobe Commerce (Magento) and PHP stack breach guide
- PHP + WordPress stack breach guide
- Shopify store security guide
- Silverstripe CMS, PHP and jQuery stack breach guide
- Webflow and hosted CMS security guide
- WordPress, PHP and Node.js stack breach guide
- WooCommerce, WordPress and PHP stack breach guide
- All stack security guides
Sources
- nextjs.org/support-policy
- nvd.nist.gov/vuln/detail/CVE-2025-55182
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182
- nextjs.org/blog/CVE-2025-66478
- nvd.nist.gov/vuln/detail/CVE-2025-29927
- github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
- github.com/nodejs/Release/blob/main/schedule.json
- nvd.nist.gov/vuln/detail/CVE-2026-111497
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
- nodejs.org/en/blog/vulnerability/october-2026-security-releases
- nvd.nist.gov/vuln/detail/CVE-2024-27980
- nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
- www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight
General information only, not legal or professional advice. Versions and CVEs change quickly; always confirm against the vendor before acting.