Next.js/React "Flight" Prototype Pollution (CVE-2025-55182)

Aaron Mog@AaronMogS2S

•updated Dec 3, 2025•28•4•733

Detects attempts to exploit CVE-2025-55182 by injecting prototype pollution vectors ("__proto__", "constructor") into React Server Component (RSC) or Next.js Server Action requests. This vulnerability allows for Remote Code Execution via object serialization flaws.