CVE-2025-66478

What it actually does

This is a critical deserialization flaw in React Server Components-related packages used directly by React 19 and by frameworks such as Next.js App Router. Affected server-side React packages can process attacker-controlled serialized data in an unsafe way, allowing a remote attacker to influence server-side execution during React Server Component or Server Action handling. In practical Next.js deployments, the most serious outcome is unauthenticated remote code execution in the Node.js server process, with access to application code, environment variables, credentials, backend network reachability, and any data the application process can access.

Why it matters to the business

Successful exploitation can turn a public web application into an entry point for full application compromise, data theft, credential exposure, service disruption, and lateral movement into connected systems. Because the vulnerability has a CVSS score of 10.0, is described as weaponized, affects widely deployed React and Next.js versions, and has been public for 250 days, organizations should treat remaining exposure as high-risk even though it is not listed in CISA KEV and is not currently marked as ransomware-associated.

How an attack unfolds

An attacker first identifies a target running affected React Server Components packages or a vulnerable Next.js 15.x or 16.x App Router application. They may fingerprint the stack using public web responses, framework behavior, exposed build artifacts, error pages, JavaScript asset patterns, or dependency disclosures. The attacker then sends a crafted request to an endpoint that causes the application to parse React Server Component or Server Action data. The malicious serialized payload is processed by one of the vulnerable react-server-dom packages, crossing a trust boundary between client-controlled input and server-side deserialization. If exploitation succeeds, attacker-controlled logic executes in the application server context. From there, the attacker can read secrets from environment variables, access application files, call internal services available to the web process, deploy a web shell or backdoor, exfiltrate data, or use the compromised application server as a foothold for further intrusion. Reported exploitation activity tracks campaigns targeting Next.js and React deserialization vulnerabilities associated with CVE-2025-55182 and CVE-2025-66478, so defenders should assume internet-facing vulnerable applications are actively probed.

How to fix it

Upgrade affected packages immediately. React users should upgrade to React 19.0.1, 19.1.2, or 19.2.1 as appropriate. Next.js users on stable 15.x or 16.x should upgrade to one of the patched stable releases: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, or 16.0.7. Environments using affected 14.3.0-canary releases starting with 14.3.0-canary.77 should downgrade to a stable 14.x release or to 14.3.0-canary.76. Ensure the patched versions are reflected in lockfiles and deployed container or server images, not only in source manifests. Rebuild and redeploy applications after upgrading. If immediate patching is impossible, reduce exposure by placing affected applications behind strong access controls, disabling or limiting vulnerable App Router/Server Action functionality where feasible, applying WAF rules for suspicious React Server Component and Server Action payloads, restricting outbound network access from application servers, rotating secrets that may be accessible to the application process, and increasing runtime monitoring. Mitigations should be considered temporary; version upgrade is the durable fix.

How to confirm the fix worked

Confirm remediation by inspecting package manifests and lockfiles for react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel, react, react-dom, and next. Use package-manager commands such as npm ls, pnpm why, yarn why, or equivalent SCA tooling to verify no affected versions remain in the resolved dependency graph. Validate that deployed artifacts, container images, serverless bundles, and build caches contain patched versions, because stale lockfiles or cached layers can preserve vulnerable code after a source-level update. For Next.js, confirm the running application reports or is built from a patched stable release: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, or 16.0.7. Avoid validating with public exploit payloads against production; use vendor-provided checks, SCA scanners, controlled staging tests, and dependency inventory verification. After deployment, review application health, error rates, and logs to confirm no new deserialization or server action processing failures were introduced.

Typical attack path

1. Discover internet-facing React/Next.js applications and fingerprint whether they use affected React Server Components or Next.js App Router versions.
2. Identify reachable routes or server action paths that accept React Server Component-related requests.
3. Send crafted serialized payloads designed to trigger unsafe server-side deserialization in react-server-dom-webpack, react-server-dom-turbopack, or react-server-dom-parcel.
4. Achieve code execution or equivalent server-side control in the Node.js application process.
5. Collect environment variables, credentials, application secrets, source code, and configuration files available to the process.
6. Establish persistence or stage tooling using writable directories, scheduled jobs, modified application files, or additional malware.
7. Move laterally to internal services reachable from the application server or exfiltrate application data.

How to detect it

To determine whether exploitation already occurred, review CDN, WAF, load balancer, reverse proxy, and web server logs for unusual POST traffic to App Router, Server Action, or React Server Component routes, especially requests carrying React/Next-specific headers such as RSC, Next-Action, Next-Router-State-Tree, or Accept: text/x-component from unfamiliar sources. These headers can be legitimate, so correlate with abnormal payload size, high request rates, probing across many routes, unusual 500 responses, and subsequent successful responses. Review application logs for deserialization errors, malformed server action payloads, unexpected React Server Component parsing failures, crashes, unhandled exceptions, or sudden increases in Node.js process restarts. Use EDR and host telemetry to hunt for node or next-server processes spawning shells or utilities such as sh, bash, cmd, powershell, curl, wget, python, perl, nc, ncat, chmod, or openssl. Check for unexpected outbound connections from the application runtime shortly after suspicious requests, especially to newly observed IP addresses, paste sites, file-sharing services, tunneling services, or cryptocurrency/ransomware infrastructure. Inspect writable directories, application deployment paths, temporary directories, and build/cache locations for recently created scripts, web shells, modified JavaScript files, unauthorized cron/systemd entries, or persistence mechanisms. Review cloud audit logs and secrets-management access logs for unusual reads of secrets or configuration by the application identity. Because exploitation campaigns have been reported against the related Next.js/React deserialization issue, prioritize retrospective hunting from the publication date forward and across any period when affected versions were deployed.

What your security team should do

• Prioritize emergency patching for all internet-facing Next.js App Router and React Server Components applications using affected versions.
• Create an inventory query for react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel, React 19.0.0/19.1.0/19.1.1/19.2.0, and Next.js 15.x/16.x, including transitive dependencies and container images.
• Treat systems that were vulnerable while publicly reachable as potentially compromised and perform retrospective hunting across web, application, EDR, and cloud logs.
• Rotate application secrets, API keys, session-signing keys, and service credentials where exploitation cannot be confidently ruled out.
• Add temporary WAF and CDN detections for anomalous React Server Component or Server Action requests, but do not rely on filtering as a substitute for upgrading.
• Restrict outbound egress from application runtimes to reduce post-exploitation command-and-control and data exfiltration opportunities.
• Monitor Node.js processes for child process execution, unexpected shell commands, network tooling, file writes in application directories, and outbound connections to untrusted destinations.
• Remove or downgrade affected Next.js 14.3 canary builds starting with 14.3.0-canary.77.
• Ensure CI/CD pipelines fail builds that resolve to vulnerable React Server DOM or Next.js versions.
• Brief application owners that this is weaponized and publicly known despite not currently appearing in CISA KEV.