Vuln: CVE-2025-66478 | Detection.FYI

Suspicious React Server Child Process

Sep 19, 2026 · Domain: Endpoint OS: Linux OS: macOS OS: Windows Use Case: Threat Detection Tactic: Initial Access Data Source: Elastic Defend Data Source: Auditd Manager Data Source: SentinelOne Data Source: Sysmon Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Windows Platform: Linux Platform: macOS Vuln: CVE-2025-55182 Vuln: CVE-2025-66478 Threat: React2Shell ·
Share on:

This rule detects suspicious child process activity from a React server application. This could be related to successful exploitation of CVE-2025-55182 or CVE-2025-66478. These vulnerabilities allow attackers to execute remote code due to insecure deserialization of React Server Components (RSC) Flight payloads, leading to unauthenticated RCE on servers running React 19.x or Next.js 14.3.0-canary+, 15.x, and 16.x with the App Router enabled

Read More