React Server Components (RSC) Prototype Pollution & RCE Attempt

Aaron Mog@AaronMogS2S

•updated Dec 3, 2025•100•8•2,343

Detects attempts to exploit CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) by identifying Prototype Pollution vectors (__proto__, constructor) specifically targeting the React Flight protocol (RSC headers/params). Covers both clear-text and common JSON escape sequences. The rule also correlates with 500 errors to identify potential successful exploitation or blind probing attempts.