← Railway

2025 Railway — Next.js CVE, cryptomining attack

2025 Unknown records affected Share on X

Data compromised

Workload compromise; potential secret exposure

Technical writeup

Attackers exploited CVE-2025-55182 (React Server Components/Next.js). Customer workloads hijacked for cryptomining. <10% workloads, <1% private traffic (Europe West). No env var exfiltration evidence; users advised to rotate secrets.

Root cause

Vulnerability exploitation; CVE-2025-55182

References