PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2025-55182 and CVE-2025-66478 (“React2Shell”): All you need to know – UPDATED

jfrog.com | vulnerability | #rce | #vulnerability | #cve | #jfrog | #react2shell | #nextjs | #cve-2025-55182 | #cve-2025-66478 | #react | #jfrog-com
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

JFrog's living advisory on React2Shell (CVE-2025-55182 / CVE-2025-66478): a near-100%-success RCE in React Server Functions and Next.js, now with public exploits, plus follow-on DoS fixes.
Published
Collected

Related coverage

blog · portswigger.net
How to detect React2Shell with Burp Suite
Burp Suite's default scans now detect React2Shell (CVE-2025-55182 and CVE-2025-66478), two critical unauthenticated RCE flaws in React server components affecting Next.js applications.
Critical · vulnerability · xbow.com
React2Shell (CVE-2025-55182): A Wake-Up Call for Modern Web Security and How XBOW Helps You Respond
Covers React2Shell (CVE-2025-55182), an unauthenticated RCE in React Server Components' serialization that also affects Next.js and more, and how to quickly scope exposure.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
vulnerability · blog.quarkslab.com
Snapshotting our way to CVE-2026-9539
This blog post presents a LibAFL-Qemu based way to explore state machines and why we failed to find CVE-2026-9539.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
Back