Who is impacted?

Many services are potentially vulnerable. Next.js is one of the most popular React frameworks, used by companies of all sizes - from startups to enterprises. The App Router with React Server Components has been the default architecture for new Next.js projects since version 13, meaning most modern Next.js deployments are affected.

Any application using:

• React Server Components with vulnerable react-server-dom-* packages (19.0.0 - 19.2.0)
• Next.js App Router versions 15.x (before 15.0.5) and 16.x (before 16.0.7)

This includes production deployments on Vercel, AWS, self-hosted infrastructure, and anywhere else Next.js App Router applications run.

Not affected:

• Next.js Pages Router applications (no RSC)
• Next.js 13.x and 14.x stable releases
• Applications using only React client-side rendering
• Edge Runtime deployments (no process.mainModule available)

Affected Versions

React Server Components

Next.js

Mitigation

Upgrade immediately. There are no workarounds.

For Next.js applications:

For direct React RSC usage:

Verify your installed versions:

How the exploit works

Exploit Requirements

1. A server running vulnerable React Server Components (via Next.js App Router or direct RSC usage)
2. Network access to send an HTTP POST request
3. That's it. No authentication. No specific endpoint. Any route works.

The Attack

Multiple attack vectors have been discovered for this vulnerability. The most common - and the one that works without any prerequisites - uses prototype pollution via React's Flight protocol reference system.

The exploit sends a crafted multipart POST request with a Next-Action header. The payload abuses the reference system to:

1. Traverse the prototype chain via $1:__proto__:then
2. Construct a fake "chunk" object that mimics React's internal Chunk class
3. Trick the deserializer into calling the JavaScript Function constructor
4. Execute arbitrary code when the resulting function is invoked as a Promise thenable

The code executes during deserialization, before any action ID validation occurs. This means any Next-Action header value triggers the vulnerable code path - no valid action ID is required.

Other attack vectors exist, including $F function references and direct module gadgets. These typically require a valid action ID. See Alternative Attack Vectors for details.

The Root Cause

React's Flight protocol resolves references like $1:path:to:value by splitting on colons and traversing the object:

The Irony: At the top of this very file, line 35:

root@kitploit:~

import hasOwnProperty from 'shared/hasOwnProperty';

The guard was imported. It was available. It just wasn't used in the one loop where it mattered most.

This single missing check allows $1:__proto__:then to traverse from a chunk object, up the prototype chain, to Chunk.prototype.then - a function that processes Promise-like objects. By crafting a fake chunk with the right properties, we control what code gets executed.

Reproducing Locally

Clone the vulnerable test server:

In another terminal:

A vulnerable server returns HTTP 500 with E{"digest" in the response body. To demonstrate RCE:

Command output appears in the response. For interactive exploration:

What's in This Repo

Vulnerable Test Server

The vulnerable-next-server/ directory contains a pre-configured Next.js 16.0.6 + React 19.2.0 application for safe local testing. It runs on port 3443 by default. This is a minimal App Router setup demonstrating that default configurations are vulnerable.

Exploit Scripts

We developed multiple exploit variants to handle different scenarios:

Production Note: React strips error messages in production builds, breaking the throw method. Only exploit-redirect.sh reliably captures command output in production without prerequisites. The redirect URL is stored in the error's digest property (metadata), which isn't sanitized - unlike message which becomes {digest: "..."} only.

Utility Scripts:

• detect.sh - Non-destructive vulnerability probe (no code execution)
• enumerate-actions.sh - Discovers valid Server Action IDs from target HTML
• exfil-file.sh - Chunked file exfiltration (auto-handles large files)
• shell.sh - Interactive pseudo-shell over RCE

The redirect method is recommended because it works in production, requires no prerequisites, and returns command output directly. It works by throwing a specially crafted NEXT_REDIRECT error - the output is base64-encoded into the redirect URL and returned in the x-action-redirect header.

For detailed usage of each script, see USAGE.md.

How to detect vulnerable servers

Quick Detection

This sends a minimal probe that triggers the vulnerable code path without executing arbitrary code.

Vulnerable server response:

• HTTP status: 500
• Content-Type: text/x-component
• Body contains: E{"digest"

Patched or non-RSC server: Returns 404, different error format, or no Flight protocol response.

Manual Detection

This probe references a non-existent property on an empty object. Vulnerable servers crash trying to access {}.a.a, returning 500. Patched servers have a hasOwnProperty guard that prevents the crash.

Identifying Next.js App Router

Look for these indicators:

• RSC payload in HTML: <script> tags containing Flight protocol data (0:, 1:, etc.)
• x-nextjs-cache or x-nextjs-matched-path headers
• /_next/ static asset paths
• Server Action IDs in HTML: $ACTION_ID_ patterns in hidden form fields

Technical Deep Dive

The Attack Flow

The following diagram illustrates how a single HTTP request achieves remote code execution:

The Flight Protocol

React Server Components use a custom serialization format called "Flight" to stream component trees from server to client. It uses prefix codes for different value types:

• $1, $2, ... - References to other chunks by ID
• $@0 - Raw chunk object reference (returns the chunk itself, not its value)
• $B0 - Blob reference (triggers _formData.get(_prefix + id))
• $1:path:to:prop - Traverses a path on a referenced chunk's value

The vulnerability exploits the combination of $@ (raw reference) and colon-delimited paths to access __proto__.

The Complete Attack Chain

Phase 1: Request Processing

1. POST with Next-Action header triggers RSC action handling
2. Busboy parses multipart form fields into chunk storage
3. await getRoot(response) returns chunk 0 as a thenable

Phase 2: Prototype Traversal

4. Chunk has a then method - JS Promise spec calls thenable.then(resolve, reject)
5. Our payload is parsed; $1:__proto__:then resolves to Chunk.prototype.then
6. Fake chunk object created with then, status: "resolved_model", and _response

Phase 3: Code Execution

7. resolve(ourObject) triggers another then() call (JS thenable spec)
8. Chunk.prototype.then runs using our controlled _response object
9. $B0 triggers _formData.get(_prefix + "0") - both attacker-controlled
10. Constructed Function called as thenable → RCE

Phase 4: Output Exfiltration (optional, redirect method)

11. Payload throws NEXT_REDIRECT error with base64-encoded command output
12. Next.js catches redirect, sets x-action-redirect header before URL validation
13. HTTP 303 returned to attacker with output in header

Output Capture Strategies

The constructed Function is called as a thenable: fn(resolve, reject). How we handle this determines whether we get output back:

Recommended: Redirect. Works in production, no prerequisites, output in x-action-redirect header.

The blind approach hangs because the Promise never settles - await blocks forever. This is useful for fire-and-forget scenarios (reverse shells, out-of-band exfil via curl).

Alternative Attack Vectors

The core vulnerability has been exploited through three distinct attack classes. This repository uses the first approach; other PoCs demonstrate the alternatives:

Why prototype pollution doesn't require an action ID: Multipart form parsing feeds chunks to the Flight deserializer immediately. RCE occurs in getOutlinedModel() during chunk reference resolution - before Next.js validates the action ID. URL-encoded requests validate the action ID first (different code path at action-handler.ts:768).

Why $F reference requires an action ID: The $F reference triggers loadServerReference(), which performs a manifest lookup. If the action doesn't exist, the request fails before code execution.

For detailed analysis of all PoC implementations and their tradeoffs, see external-pocs/COMPARISON.md.

Production vs Development

React strips error details in production builds. This affects the throw-based exfiltration:

Development:

Production:

The redirect method bypasses this because the redirect URL is stored in the digest property, not message. The header is set unconditionally before URL validation, so even invalid URLs get the header set.

Acknowledgments

The key exploitation insight - using $@ raw chunk references to create a self-referential fake chunk - is credited to maple3142. The detection methodology referenced here comes from Searchlight Cyber / Assetnote.

References

Official Disclosures:

• CVE-2025-55182 - React Server Components RCE
• CVE-2025-66478 - Next.js downstream impact
• React Security Advisory - Official React disclosure

Community Research:

For detailed comparison of all PoC implementations, see external-pocs/COMPARISON.md.

Background:

• React Flight Protocol - Understanding RSC serialization

License

Code is licensed under the MIT License. Documentation (*.md files) is licensed under CC-BY-SA 4.0.