Hackers Exploit Next.js Vulnerability to Compromise Hundreds of Hosts

Hackers exploited a newly disclosed software vulnerability to breach 766 Next.js hosts and steal user credentials, security researchers confirmed on Wednesday.

The attack leveraged CVE-2025-55182, a critical flaw in the popular web framework, to gain unauthorized access to the targeted systems. The breach was detected on April 2, 2026, at approximately 19:48 UTC. The compromised hosts were distributed across various locations, though the specific geographic origins of the victims have not been publicly identified.

The vulnerability allows attackers to bypass authentication mechanisms and extract sensitive data stored within the affected applications. Security experts warn that the stolen credentials could be used for further unauthorized access or sold on dark web marketplaces. The scale of the operation suggests a coordinated effort by a sophisticated threat actor or group.

Next.js, developed by Vercel, is widely used for building server-side rendered and static websites. The framework's popularity makes it a frequent target for cybercriminals seeking to exploit common web application vulnerabilities. The discovery of CVE-2025-55182 has prompted immediate action from the developer community to patch affected systems.

Vercel has released an advisory detailing the vulnerability and provided guidance for users to secure their applications. The company urged administrators to update their Next.js installations immediately to prevent further exploitation. The advisory also recommended rotating all compromised credentials and implementing additional security measures such as multi-factor authentication.

The attack highlights the ongoing risks associated with unpatched software vulnerabilities. Cybersecurity firms emphasize the importance of timely updates and proactive monitoring to mitigate potential threats. The incident serves as a reminder of the need for robust security practices in web development.

While the immediate threat has been addressed, the long-term impact of the breach remains uncertain. The stolen credentials could be used in future attacks, and the full extent of the data exfiltration is still being assessed. Security researchers are continuing to monitor the situation for any signs of further exploitation.

The identity of the attackers and their motivations remain unknown. Law enforcement agencies have not commented on the incident, and no claims of responsibility have been made. The investigation is ongoing, and more details may emerge in the coming days.

Organizations affected by the breach are advised to conduct thorough security audits and implement enhanced monitoring to detect any suspicious activity. The incident underscores the critical need for continuous security awareness and preparedness in the digital landscape.