Node2Shell flaw lets attackers hijack Node.js servers; KISA urges updates KISA warns of high‑risk Node2Shell bug in Node.js, ...

The RondoDox botnet has been observed exploiting the critical React2Shell flaw (CVE-2025-55182) to infect vulnerable Next.js servers with malware and cryptominers. First documented by Fortinet in July ...

A high-severity React Server Components DoS flaw lets attackers freeze vulnerable Next.js servers with crafted POST requests.

Next.js maintainers have released an out-of-band security update addressing two critical remote code execution vulnerabilities and a high-severity denial-of-service flaw.