EUVD-2025-203822

tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in @trpc/server's formDataToObject function, which is used by the Next.js App Router...

Exploit for Deserialization of Untrusted Data in Facebook React

🔍 Next.js RCE Scanner - CVE-2025-55182 & CVE-2025-66478...

Exploit for Deserialization of Untrusted Data in Facebook React

Next.js CVE-2025-55182 Proof of Concept This is a proof-of-co...

PT-2025-54682

Note that this vulnerability is only present when using experimental caller / experimental nextAppDirCaller. Summary A Prototype Pollution vulnerability exists in @trpc/server's formDataToObject function, which is used by the Next.js App Router adapter. An attacker can pollute Object.prototype by...

EUVD-2025-203449

LikeC4 has RCE through vulnerable React and Next.js versions...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 React2Shell Exploit Kit 🎯 Complete Workin...

Exploit for CVE-2025-66478

CVE-2025-66478 Exploit PoC This repository contains proof-of-...

unauthenticated remote code execution vulnerability in React Server Components. React (CVE-2025-55182), Next.js (CVE-2025-66478).

CVE-2025-55182 Description: A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable co...

Exploit for Deserialization of Untrusted Data in Facebook React

Next.Js React Server Components RSC Vulnerabilities This re...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell – Advanced Discovery & Exploitation Framework An...

Exploit for Deserialization of Untrusted Data in Facebook React

React2P4IM0Nshell 💥Extension Tool para...

Exploit for Deserialization of Untrusted Data in Facebook React

This is a Next.js project bootstrapped wit...

Exploit for Deserialization of Untrusted Data in Facebook React

ReactOOPS - HTB Web Challenge Writeup...

@atomos_tech/katerpillar (1.0.0), katalyst-riya-test (>=1.0.0, <=1.0.3) potentially affected by unknown CVE via next (15.4.9)

next NPM version 15.4.9 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @atomostech/katerpillar 1.0.0 - katalyst-riya-test =1.0.0, =1.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-5J59-XGG2-R9C4...

GHSA-5J59-XGG2-R9C4 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

It was discovered that the fix for CVE-2025-55184 in React Server Components was incomplete and did not fully mitigate denial-of-service conditions across all payload types. As a result, certain crafted inputs could still trigger excessive resource consumption. This vulnerability affects React...

Exploit for Deserialization of Untrusted Data in Facebook React

rsc-exposure-audit Black-box exposure audit for Next.js / Reac...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Mass Payload Attack React2Shell A modified M...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell Scanner & PoC Security tools for detecting CVE-...

Exploit for Deserialization of Untrusted Data in Facebook React

react2shell-scanner A command-line tool for detecting CVE-202...

React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation

The U.S. Cybersecurity and Infrastructure Security Agency CISA has urged federal agencies to patch the recent React2Shell vulnerability by December 12, 2025, amid reports of widespread exploitation. The critical vulnerability, tracked as CVE-2025-55182 CVSS score: 10.0, affects the React Server...