Suricata Detection Rule for CVE‑2025‑55182

Next.js Action Poisoning → Node.js execSync RCE

📌 Description

This document explains how Suricata rule SID 900304 detects exploitation attempts of CVE‑2025‑55182, a critical vulnerability in Next.js that enables Action Poisoning leading to arbitrary Node.js RCE, specifically through:

• Prototype Pollution
• Overriding internal React _prefix serializer
• Injected JavaScript execution inside Next.js server runtime
• Execution of OS commands via:
  root@kitploit:~

  child_process.execSync()