🔧 Fix vulnerable versions in Next.js and React RSC apps with one command to secure against CVE-2025-66478. Improve your app's safety effortlessly.

🔧 Fix vulnerable versions in Next.js and React RSC apps with one command to secure against CVE-2025-66478. Improve your app's safety effortlessly.

Published 29 Aug 2026Updated 29 Aug 202628 sources
CVSS 0.0 PoC CANDIDATE

What happened

A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.

Affected versions

Unknown product: See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

  • Review the original advisory and validate affected versions.
  • Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference
PoC-in-GitHub · Saied25/fix-react2shell-next🔧 Fix vulnerable versions in Next.js and React RSC apps with one command to secure against CVE-2025-66478. Improve your app's safety effortlessly.★ 0Saied252025-10-01CandidatePoC-in-GitHub · abtonc/next-cve-2025-66478★ 11abtonc2025-12-03CandidatePoC-in-GitHub · wangxso/CVE-2025-66478-POCCVE-2025-66478 Proof of Concept★ 5wangxso2025-12-04CandidatePoC-in-GitHub · Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478A command-line scanner for batch detection of Next.js application versions and determining if they are affected by CVE-2025-66478 vulnerability.★ 432Malayke2025-12-04CandidatePoC-in-GitHub · mattcbarrett/check-cve-2025-66478Checks if your NextJS server is vulnerable to CVE-2025-66478★ 0mattcbarrett2025-12-04CandidatePoC-in-GitHub · hackersatyamrastogi/react2shell-ultimateReact2Shell Ultimate - The most comprehensive CVE-2025-66478 Scanner for Next.js RSC RCE vulnerability. Multi-mode detection, WAF bypass, local scanning.★ 154hackersatyamrastogi2025-12-05CandidatePoC-in-GitHub · vercel-labs/fix-react2shell-nextOne command to fix CVE-2025-66478 (React 2 Shell RCE) in your Next.js / React RSC app.★ 402vercel-labs2025-12-06CandidatePoC-in-GitHub · namest504/CVE-2025-66478-Exploit-Poc★ 3namest5042025-12-06CandidatePoC-in-GitHub · aiexz/CVE-2025-66478-kinda-wafLet's help websites stay safe until they are properly patched!★ 0aiexz2025-12-06CandidatePoC-in-GitHub · Rhyru9/CVE-2025-66478★ 0Rhyru92025-12-07CandidatePoC-in-GitHub · Jibaru/CVE-2025-66478-github-patcher★ 0Jibaru2025-12-07CandidatePoC-in-GitHub · ExpTechTW/CVE-2025-66478★ 2ExpTechTW2025-12-08CandidatePoC-in-GitHub · abhirajranjan/cve-2025-66478★ 0abhirajranjan2025-12-08CandidatePoC-in-GitHub · Letalandroid/cve-2025-66478_rce_vulnerableIMPORTANTE: Proyecto de Next JS VULNERABLE creado solo para fines educativos, de pruebas y explotación, NO SE RECOMIENDA INSTALACIÓN EN PRODUCCION, SÓLO PARA ÁMBITO LOCAL O ENTORNO CONTROLADO★ 0Letalandroid2025-12-08CandidatePoC-in-GitHub · strainxx/react2shell-honeypotMy attempt to make honeypot for React2Shell vulnerability (CVE-2025-66478)★ 4strainxx2025-12-08CandidatePoC-in-GitHub · changgun-lee/Next.js-RSC-RCE-Scanner-CVE-2025-66478★ 0changgun-lee2025-12-11CandidatePoC-in-GitHub · Code42Cate/nexts-cve-2025-66478-exploit★ 0Code42Cate2025-12-11CandidatePoC-in-GitHub · viperh/poc-cve-nextPoC for Next.js RCE Vulnerability CVE-2025-66478★ 0viperh2025-12-12CandidatePoC-in-GitHub · abdozkaya/rsc-security-auditor🛡️ Audit your Next.js & React Server Components stack for critical vulnerabilities (CVE-2025-66478, CVE-2025-55184). Detects risks & generates fix commands. 100% Client-side.★ 5abdozkaya2025-12-12CandidatePoC-in-GitHub · DavionGowie/-vercel-prod.yml-application-is-vulnerable-to-CVE-2025-66478.bug bounty★ 0DavionGowie2025-12-14CandidatePoC-in-GitHub · DavionGowie/-vercel-application-is-vulnerable-to-CVE-2025-66478.bug bounty★ 0DavionGowie2025-12-14CandidatePoC-in-GitHub · zhixiangyao/CVE-2025-66478-Exploit-PoCProof-of-concept exploit demo for CVE-2025-66478 using Node.js★ 1zhixiangyao2025-12-15CandidatePoC-in-GitHub · khadafigans/React2ShellReact2Shell - CVE-2025-66478 RCE Exploit★ 6khadafigans2025-12-30CandidatePoC-in-GitHub · Z3ROROOT3R/CVE-2025-66478★ 0Z3ROROOT3R2025-12-31CandidatePoC-in-GitHub · imad457/NextJS-RCE-Root-TakeoverPentest Report: Next.js 16.0.6 RCE (CVE-2025-66478)★ 2imad4572026-01-05CandidatePoC-in-GitHub · nilfredb/CVE-2025-66478-Research-Proof-of-Concept★ 0nilfredb2026-05-30CandidatePoC-in-GitHub · JotaEspig/CVE-2025-66478-PoC-Reverse-ShellCVE-2025-66478 PoC★ 1JotaEspig2026-08-30Candidate