RCE: Anomalous RSC Request Payload

Mehulkumar Savajani@Msavajani

•updated Dec 9, 2025•44•4•430

Detects multiple large POST requests to Next.js or React Server Component (RSC) endpoints from the same source IP. This pattern can indicate attempts to exploit unsafe deserialization vulnerabilities like React2Shell (CVE-2025-55182) by sending a crafted, oversized payload.