Skip to content
HackIndex logo

HackIndex

CVE-2025-66478:
React2Shell

Published: Feb 21, 2026
Critical
Marshaling, Unmarshaling

Notice

This is a duplicate CVE of https://hackindex.io/vulnerabilities/CVE-2025-55182. Please visit that page for all the details and instructions.

Unauthenticated pre-auth RCE in React Server Components (RSC) Flight protocol. Root cause: unsafe deserialization of client-submitted payloads, allowing prototype pollution to reach the Node.js Function constructor.

Affects default Next.js apps (App Router), even without explicit server actions. Standard create-next-app production builds are vulnerable out of the box. Also hits Waku, React Router RSC, etc.

Affected packages:

  • Next.js

Next.JS React RCE