• README.md - issue write-up and exploit chain
• vulnerable-code.md - relevant pre-patch source excerpts
• patch.diff - upstream fix or the closest public patch material
• exploit.py and exploit.sh - runnable exploit primitives
• expected-output.txt - reference behavior
• vulnerable-app/ - a minimal Next.js app or stub service used for reproduction

Coverage

This repo covers 12 advisories fixed in the v16.2.4..v16.2.5 release window:

The detailed severity, CVSS, CWE mapping, and hosting applicability live in poc/README.md.

Getting started

1. Read SUMMARY.md for the release-window analysis.
2. Read poc/README.md for the full advisory table and attack-surface overview.
3. Pick a PoC directory and start with its local README.md.
4. Run the matching exploit against a vulnerable target.

Run a single PoC:

Run the whole collection:

Most exploits assume a vulnerable Next.js v16.2.4 target. Some directories instead ship a small stub service in vulnerable-app/ when reproducing the bug against a full Next.js install would add too much setup overhead.

Safety

• Test only against systems you own or are explicitly authorized to assess.
• Upgrade targets to next@>=16.2.5 to pick up the upstream fixes.
• If your work turns up a new variant, report it privately through the Next.js security process instead of disclosing it in public.