CVE-2025-66478: 
Next.js vulnerability analysis and mitigation

CVE-2025-66478 is a rejected/duplicate CVE that was originally assigned to describe a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC) and Next.js frameworks, colloquially dubbed "React2Shell." It was formally rejected because it is a duplicate of CVE-2025-55182, which is the canonical identifier for this vulnerability. The flaw affects React versions 19.0.0–19.2.0 (specifically the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages) and Next.js versions 15.x and 16.x using the App Router. It was disclosed on December 3, 2025, by Vercel/Next.js via GitHub Security Advisory GHSA-9qr9-h5gf-34mp. The CVSS v3.1 base score is 10.0 (Critical) (GitHub Advisory, NVD).

The root cause is CWE-502: Deserialization of Untrusted Data in the React Flight protocol — the binary serialization format used by React Server Components to stream component data from server to client. An attacker can send a specially crafted HTTP request containing a malicious React Flight payload to any endpoint that processes RSC data, causing the server to deserialize and execute arbitrary JavaScript/server-side code. No authentication, privileges, or user interaction are required; the attack vector is fully network-accessible. The vulnerability specifically resides in the react-server-dom-* packages (parcel, turbopack, webpack) when used in server-rendering contexts. Experimental canary releases of Next.js starting from 14.3.0-canary.77 are also affected. Multiple public PoC exploits and Metasploit modules have been published (GitHub Advisory, Rapid7 Metasploit).

Successful exploitation grants an unauthenticated remote attacker full server-side code execution as the process running the Next.js/React application, resulting in complete compromise of confidentiality, integrity, and availability. Attackers can exfiltrate sensitive data (credentials, environment variables, secrets), deploy persistent Linux backdoors (e.g., the "PeerBlight" backdoor documented by Huntress), install cryptominers (XMRig observed in the wild), and use compromised servers as pivot points for lateral movement within cloud environments. The vulnerability was estimated to affect approximately 39% of cloud environments and over 77,000 internet-exposed IP addresses, with Operation PCPCAT compromising approximately 59,000 servers within 48 hours of disclosure (Huntress, The Hacker News, Cyble).

This vulnerability has been actively exploited in the wild within hours of public disclosure. Multiple Metasploit modules are publicly available targeting both CVE-2025-55182 and CVE-2025-66478 (Rapid7 Metasploit). Numerous standalone PoC repositories have been published on GitHub. Threat actor attribution includes Chinese nation-state-linked groups (reported by BleepingComputer and Google Cloud Threat Intelligence) and the financially motivated PCPcat campaign, which deployed credential-stealing malware and Linux backdoors across ~59,000 servers (BleepingComputer, Google Cloud TI). The EPSS score is listed as 0.0 in ENISA's EUVD (reflecting the rejected/duplicate status), but exploitation activity is extensive. The vulnerability is not separately listed in the CISA KEV catalog under CVE-2025-66478 (the canonical CVE-2025-55182 should be referenced for KEV status).

1. Reconnaissance: Use Shodan, Censys, or the open-source react2shell-scanner tool to identify internet-facing Next.js 15.x/16.x applications using the App Router, or React 19.0.0–19.2.0 with RSC enabled.
2. Identify RSC endpoint: Probe the target for React Server Component endpoints — typically any route that returns a text/x-component or application/octet-stream content type, or accepts RSC flight protocol payloads (often via ?_rsc= query parameters or RSC: 1 headers).
3. Craft malicious Flight payload: Construct a specially crafted React Flight binary payload that, when deserialized by the server, triggers execution of arbitrary server-side JavaScript. The payload exploits the unsafe deserialization in react-server-dom-webpack (or parcel/turbopack variants).
4. Send exploit request: Deliver the payload via an HTTP POST or GET request to the vulnerable RSC endpoint. No authentication headers or cookies are required.
5. Achieve RCE: The server deserializes the malicious payload and executes attacker-controlled code in the Node.js process context, enabling reverse shell establishment, credential dumping, or malware deployment.
6. Post-exploitation: Deploy persistent backdoors (e.g., PeerBlight Linux backdoor), install cryptominers, exfiltrate environment variables and secrets, or establish C2 tunnels for further lateral movement (Rapid7 ETR, Huntress).

• Network: Unusual HTTP requests to RSC endpoints (URLs containing ?_rsc=, RSC: 1 headers, or text/x-component content-type) with oversized or binary-encoded payloads; unexpected outbound connections from the Node.js process to unknown IPs on non-standard ports; traffic patterns consistent with C2 beaconing.
• Process: Unexpected child processes spawned by the Node.js/Next.js process (e.g., /bin/bash, curl, wget, python, xmrig); new cron jobs or systemd services created by the application user account.
• File System: Presence of unknown binaries or scripts in /tmp, /var/tmp, or the application directory; new SSH authorized keys added to the application user's home directory; web shells or backdoor files (e.g., PeerBlight-related ELF binaries) in the application tree.
• Logs: Next.js/Node.js access logs showing repeated requests to RSC endpoints with anomalous payload sizes or binary content; Node.js crash logs or stack traces related to deserialization errors; authentication logs showing new user creation or privilege escalation.
• Indicators from Operation PCPCAT: Presence of credential-harvesting scripts targeting environment variables (process.env), .env files, and cloud metadata endpoints; connections to known PCPcat C2 infrastructure (Beelzebub AI, Wazuh).

Immediate action: Upgrade to patched versions — React: 19.0.1, 19.1.2, or 19.2.1; Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, or canary 15.6.0-canary.58 / 16.1.0-canary.12+. Users on Next.js 14.3 canary builds (≥14.3.0-canary.77) should downgrade to a stable 14.x release or 14.3.0-canary.76. Vercel also released a scanner tool (npx next-cve-scanner) to detect affected versions in a codebase. As interim mitigations: deploy WAF rules to detect and block malformed RSC flight protocol payloads; implement network segmentation to limit outbound connections from application servers; and monitor for the IOCs listed above. Vercel announced that new deployments of vulnerable Next.js versions are blocked on their platform (GitHub Advisory, Vercel Changelog).

The vulnerability generated massive industry attention, with comparisons to Log4Shell due to its CVSS 10.0 score and the ubiquity of React/Next.js in modern web infrastructure. Vercel published multiple advisories and blog posts, and blocked vulnerable deployments on their platform. Google Cloud, AWS, Okta, Cloudflare, Zscaler, Bitdefender, SentinelOne, Rapid7, Tenable, Qualys, and dozens of other vendors published advisories or confirmed customer protections within 24–48 hours of disclosure. The Canadian Centre for Cyber Security (CCCS) issued advisory AL25-018. Security researchers on Mastodon, LinkedIn, and Reddit widely discussed the vulnerability's severity and exploitation speed. The Hacker News, BleepingComputer, CyberScoop, and The Register all covered active exploitation. Community sentiment was alarmed, with many developers scrambling to patch and some reporting real-world compromises (including a Reddit user reporting being hacked by "Team PCP") (The Hacker News, BleepingComputer, The Register).