The loudest attacks on our Next.js site were aimed at software it never ran
This is a case study of a small business website we designed and built. To see whether the design held up, we read its own edge logs over a 28-day window. Nothing here is a client’s data, and the site is not named. It is a Next.js application on Node behind a reverse proxy, and a worked example of how a modern site is actually attacked, and how building it carefully answered that. Start with the…
The research presented in this case study examines a small business website built using Next.js and Node.js, which was targeted by malicious automated scans. Over 28 days, the site received approximately 8,900 targeted malicious requests, averaging around 318 per day. These requests originated from 373 distinct cloud, hosting, or VPN network addresses, all hosted by providers rented by the hour. None of the requests came from residential IP addresses.
The primary targets of these scans were software components that the website did not use, such as WordPress, PHP panels, and the WordPress /wp-admin/install.php URL. The scans aimed to exploit known vulnerabilities in these components, but since the website did not use them, the attacks were unsuccessful. Consequently, all scans resulted in a 404 or 403 error.
The majority of the targeted traffic was focused on the /.env file, which was requested 228 times during the 28-day period. This file contained sensitive information, such as database credentials and API keys. However, the /.env file was not part of the website's served filesystem. Instead, secrets were injected as runtime environment variables, preventing attackers from accessing sensitive data.
The research highlights that a wall of blocked requests does not necessarily indicate that a site is well-defended. Instead, it only proves that the website is not running the software that the attackers assumed. The traffic that poses a real threat to a Next.js application involves well-formed requests to genuine endpoints, leveraging knowledge of the framework, and can be detected through advisory feeds for the specific stack.
Two notable vulnerabilities affecting Next.js applications were identified: React2Shell (CVE-2025-55182) and middleware authorization bypass (CVE-2025-29927). React2Shell is a critical remote code execution vulnerability in React Server Components, which was exploited within days of its disclosure in December 2025. Middleware authorization bypass allows attackers to bypass authentication and authorization checks by sending well-formed requests to real routes, without triggering any log anomalies.
The study emphasizes that these framework-level flaws can only be mitigated through timely patching and a disciplined update process. Configuration changes or additional security measures, such as web application firewalls (WAFs) or edge rules, provide only temporary protection and cannot address the underlying vulnerability. The research concludes that building a secure application through careful coding practices, regular updates, and minimal dependencies is the most effective approach to protect against such attacks.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
