The Programming Podcast We Need To Talk About The React Hack... (I’ve Never Seen A Vulnerability This Bad.)
Dec 11, 2025
A critical vulnerability in React and Next.js caused chaos, allowing servers to be hijacked for crypto mining. The hosts detail the shocking mechanics of this exploit and share a simple fix to safeguard your projects. They also dive into the concept of 'Tourist Developers,' urging listeners to stop endlessly learning and start shipping code. The discussion touches on productivity hacks like the parking lot method to help tech professionals focus and achieve their goals. Stay updated and keep your coding practices sharp!
AI Snips
Chapters
Transcript
Episode notes
Self-Hosted Server Hijacked For Crypto Mining
- Eduardo woke to an email that his Hetzner VPS was blocked because it was mining crypto and attacking others.
- The attacker ran a sophisticated miner inside his Next.js container and achieved 361% CPU usage across a 415-node botnet.
Never Run Containers As Root
- If you deploy Node/Next.js in Docker, do not run containers as root; create and use a non-root user like 'next'.
- Changing the Dockerfile user prevents a container compromise from giving root on the host.
Flight Protocol Can Expose Runtime Internals
- The exploit abused React Flight streaming by sending specially crafted chunk references that traverse prototype chains.
- That allowed attackers to reach Function constructors and execute arbitrary code server-side (RCE).