Critical 10.0
CVE-2025-66478
Server Compromise via CVE-2025-66478 Exploitation
Vendor / product: Next.js / React Server Components
Event date: 2025-12-03
Public PoC: Yes
First tracked by RiskWire: 2026-09-21
Sources & citations (1)
- The Night Our Server Got Owned — and Why I Built DevCompass dev.to · 2026-09-21
References
See CVE-2025-66478 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →