JavaScript/Node.js Ecosystem Vulnerabilities: Next.js React2Shell Exploitation and Prototype-Pollution/DoS Bugs in Axios and CASL

Threat actors began actively exploiting React2Shell (CVE-2025-55182), a critical issue affecting Next.js and React Server Components that can enable unauthenticated remote code execution on vulnerable, internet-facing servers. Reporting describes exploitation starting within ~20 hours of public disclosure, with attacks observed as malicious HTTP POST requests targeting routes such as /_next/server and /_next/flight, abusing server-component serialization to inject commands into the application runtime. WhoisXMLAPI attributed a large share of scanning/exploitation activity to the “ILOVEPOOP” toolkit, which used centralized infrastructure (noted as high-traffic nodes hosted in the Netherlands), rotating scanner nodes, and a distinctive request fingerprint including non-standard headers like X-Nextjs-Request-Id: poop1234 and Next-Action: x.

Separately, two additional JavaScript supply-chain/library vulnerabilities were disclosed that can be triggered via attacker-controlled input in Node.js applications. Axios is affected by a high-severity denial-of-service flaw (CVE-2026-25639, CVSS 7.5) in mergeConfig, where a configuration object containing an own __proto__ property can cause a TypeError and crash the Node.js process when user input is parsed (e.g., via JSON.parse()) and passed into Axios configuration. CERT/CC also published VU#458422 for a prototype pollution vulnerability in CASL Ability (versions 2.4.0–6.7.4) in rulesToFields() / setByPath() (extra module), where insufficient sanitization of path segments allows writing to Object.prototype via special keys (e.g., prototype, constructor, and _proto_), potentially enabling broad application compromise up to arbitrary code execution depending on how polluted properties are later used.