CVE-2025-66478

Next.js RCE Vulnerability Research Lab

CVSS 10.0 Critical

Vulnerability Details

Affected Versions:

Next.js 15.x
Next.js 16.x
Next.js 14.3.0-canary.77+
React Server Components 19.x

Vector:

React Server Components Flight Protocol Deserialization

Impact:

Unauthenticated Remote Code Execution

Technical Analysis

Root Cause:

Unsafe deserialization of Flight protocol payloads allows prototype pollution

Exploitation:

Crafted HTTP requests to Server Function endpoints

Result:

Arbitrary code execution with server privileges

Live Exploit Demonstration

$ exploit_cve_2025_66478.sh

Click "Run Exploit Demo" to test the vulnerability...

Ready for next exploit

Malicious Payload Examples

Prototype Pollution

{
  "then": "$1:__proto__:constructor:constructor",
  "command": "malicious_code"
}

Flight Protocol Bypass

POST / HTTP/1.1
Next-Action: malicious
Content-Type: multipart/form-data

--boundary
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:constructor"}
--boundary--

Mitigation & Patching

Patched Versions:

Next.js 15.0.5+
Next.js 15.1.9+
Next.js 15.2.6+
Next.js 16.0.7+
React 19.0.1+

Immediate Actions:

Upgrade dependencies immediately
Rotate all secrets
Audit server logs
Review access controls

View Technical Details