Detect attack attempts in error reports.
Some of your errors aren't bugs but scanners trying known vulnerabilities. Fehlo labels them as attack attempts, groups them and keeps them out of your alerts.
The problem
Scanners try every public website. Some of their requests crash your framework, and the SDK reports the crash as an error. An example from Next.js: a request with a forged x-middleware-subrequest header and a React Server Components payload throws "Invariant: Expected RSC response". Errors are grouped by route, so after one scan you see a dozen new issues whose titles blame the framework, and your phone goes off at night for nothing.
Fehlo recognises known attack patterns in the request and the error message and labels the affected issues "attack attempt".
Patterns Fehlo recognises
| Rule | what Fehlo looks for | Identifier |
|---|---|---|
| React2Shell: remote code execution through React Server Components | Server Action requests (next-action header) whose payload reaches the prototype chain to run code on the server | CVE-2025-55182, CVE-2025-66478 |
| Next.js middleware bypass | a forged x-middleware-subrequest header that skips the middleware and the auth checks in it | CVE-2025-29927 |
| Log4Shell | ${jndi:...} in headers, URL, body or message | CVE-2021-44228 |
| Spring4Shell | request parameters bound to class.module.classLoader to write a web shell | CVE-2022-22965 |
| SQL injection | UNION SELECT probes, quoted tautologies and time delays in URL, query or body | CWE-89 |
| Path traversal | ../ walks and absolute paths to /etc/passwd, /proc/self/environ and similar files | CWE-22 |
| Probe for secret files | requests for /.env, /.git/config, wp-config.php and cloud credential files | CWE-538 |
| WordPress and PHP probes | xmlrpc.php, wp-login.php and wp-admin against an app that isn't PHP |
Precision comes before recall. A real bug labelled as an attack and silenced would be worse than an attack that stays an ordinary issue. So Fehlo only labels an issue when its first event matches. An attack event that lands in an issue that real errors created stays unlabelled.
What happens next
- No alerts. Labelled issues don't alert. The check also runs right before each alert, so a fresh attack never notifies in the first place. Each project can switch this off.
- One attack, not twelve issues. Issues of the same project and rule within 30 minutes of each other form one attack. The issue page shows the evidence (which header, which parameter) and every issue of the attack.
- One click to clean up. "Ignore all" or "Merge" for the whole attack. If Fehlo got it wrong, "Not an attack" removes the label, and later checks leave that issue alone.
- Filters on the issue list: all issues, hide attacks, or attacks only. The overview shows attacks from the last seven days.
Every two minutes Fehlo checks the latest event of each issue that is receiving events, and its first run went back 14 days. Events are not changed at ingest.
What it is not
Fehlo is not a web application firewall. It blocks nothing; it tells you afterwards which issues an attack caused. Patterns no rule knows stay ordinary issues. A labelled React2Shell or middleware request doesn't mean it succeeded, but it is a good reason to check your Next.js and React versions. The vulnerability scan shows which ones you run.
Attack detection is included in every plan. Through the MCP server, AI agents see the label on each issue and can list recent attacks.
Sources
- React blog, "Critical Security Vulnerability in React Server Components", react.dev.
- Next.js security advisory GHSA-f82v-jwr5-mffw (CVE-2025-29927), github.com/vercel/next.js.
- CVE-2021-44228, cve.org; CVE-2022-22965, spring.io.
- OWASP, "SQL Injection", "Path Traversal", "Forced browsing", owasp.org.
The rules are built into Fehlo; the issue page links the source of each one.
Questions
Does Fehlo block attacks?
No. Fehlo only sees requests once they have caused an error, and labels those issues. To block, use a firewall or rules in your reverse proxy.
What if a real bug is labelled as an attack?
Click "Not an attack" and the label goes away; later checks leave the issue alone. Fehlo only labels issues whose first event matches a pattern in the first place.
Will I hear nothing about attacks?
Labelled issues don't alert. The overview shows attacks from the last seven days. If you want alerts for attacks too, switch it off in the project settings.
Do I need a different SDK?
No. Fehlo reads the request data the SDK already sends: method, URL, headers and body, as far as your SDK sends them.