Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-32421 — Comprehensive demonstration of CVE-2025-32421 Eclipse technique - a sophisticated race condition attack against Next.js 15.0.4 that bypasses the original CVE-2024-46982 patch. | Kitploit
Tools/GitHubGitHub/hidesec/cve-2025-32421
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationLabs & Practice
GitHubhidesec/cve-2025-32421

CVE-2025-32421

Comprehensive demonstration of CVE-2025-32421 Eclipse technique - a sophisticated race condition attack against Next.js 15.0.4 that bypasses the original CVE-2024-46982 patch.

View Repository
1111 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-32421 Eclipse Technique Lab

Comprehensive demonstration of CVE-2025-32421 Eclipse technique - a sophisticated race condition attack against Next.js 15.0.4 that bypasses the original CVE-2024-46982 patch.

WARNING - EDUCATIONAL PURPOSE ONLY

This laboratory is designed exclusively for:

  • Security research and education
  • Vulnerability assessment training
  • Understanding attack vectors
  • Developing security awareness

DO NOT USE FOR:

  • Unauthorized testing on systems you don't own
  • Malicious attacks or exploitation
  • Production environments

Eclipse Technique Overview

The Eclipse technique exploits a race condition in Next.js 15.0.4's promise batcher mechanism, allowing attackers to share cached results between requests and leak sensitive server-side data that should remain private.

Key Technical Details

  • Target: Next.js 15.0.4 promise batcher vulnerability
  • Method: Race condition via simultaneous requests
  • Vector: /_error-0 cacheKey collision
  • Impact: Sensitive server-side data exposure

Repository Structure

root@kitploit:~
CVE-2025-32421/
├── exploits/
│   ├── cve-2025-32421-eclipse-exploit.js
│   ├── cve-2025-32421-demo.js
│   ├── cve-2025-32421-simple-demo.js
│   └── cve-2025-32421-xss-eclipse.js
├── pages/
│   ├── _app.tsx
│   ├── _app_xss_cve2025.tsx
│   ├── _error.tsx
│   ├── index.tsx
│   └── 404.tsx
├── package.json
├── next.config.js
├── README.md
└── tsconfig.json

Quick Start

1. Install Dependencies

root@kitploit:~
npm install

2. Start Vulnerable Application

root@kitploit:~
npm start

3. Run Eclipse Exploits

Basic Eclipse Demo

root@kitploit:~
node exploits/cve-2025-32421-demo.js

Full Eclipse Exploitation

root@kitploit:~
node exploits/cve-2025-32421-eclipse-exploit.js

XSS + Eclipse Combined Attack

root@kitploit:~
node exploits/cve-2025-32421-xss-eclipse.js --demo
node exploits/cve-2025-32421-xss-eclipse.js

Exploitation Techniques

1. Eclipse Race Condition (CVE-2025-32421)

  • Success Rate: 100% (50/50 tests)
  • Data Exposure: Monitoring config, admin preferences
  • Vector: Promise batcher collision

2. XSS + Eclipse Combined

  • Success Rate: 100% (6/6 payloads)
  • XSS Vector: Unsafe cookie handling
  • Data Leakage: Sentry DSN, admin settings
  • Impact: Critical - Full compromise possible

Testing Results

Eclipse Technique Performance

root@kitploit:~
Promise Batcher Exploitation: 100% success
Data Exposure Rate: 50/50 attempts
Monitoring Config Leaked: YES
Admin Preferences Exposed: YES
Race Condition Reliability: Perfect

XSS + Eclipse Combined

root@kitploit:~
XSS Injection Success: 6/6 payloads
Eclipse Data Exposure: 100%
Combined Attack Rate: 100%
Critical Vulnerability: CONFIRMED

Vulnerability Details

CVE-2025-32421 Impact

  • Severity: Critical
  • CVSS Score: 9.0+ (estimated)
  • Attack Vector: Network
  • Complexity: Low
  • Authentication: None required

Data Exposure

  • Monitoring/Sentry DSN keys
  • Admin mode preferences
  • User session data
  • Internal configuration
  • Environment variables

Technical Implementation

Eclipse Race Condition

  1. Simultaneous Requests: Multiple requests to trigger promise sharing
  2. Cache Collision: /_error-0 cacheKey manipulation
  3. Data Leakage: Server-side data exposed in client responses
  4. Privilege Escalation: Admin mode detection and exploitation

XSS Integration

  1. Cookie Injection: Unsafe handling of theme parameter
  2. Admin Simulation: role=admin cookie for elevated privileges
  3. Data Extraction: JavaScript execution for monitoring data
  4. Persistence: Multiple XSS vectors for reliability

Remediation

Immediate Fixes

  1. Upgrade Next.js: Patch to latest version
  2. Input Sanitization: Validate all user inputs in getInitialProps
  3. Content Security Policy: Implement strict CSP headers
  4. Cookie Validation: Sanitize all cookie values
  5. Rate Limiting: Prevent race condition attacks

Security Best Practices

  • Remove sensitive data from client-side exposure
  • Implement proper session management
  • Add monitoring for suspicious request patterns
  • Regular security audits and penetration testing

References

  • CVE-2025-32421: Eclipse on Next.js Research
  • Original CVE-2024-46982: Next.js SSR vulnerability
  • Next.js Security: Official security guidelines

Research Credits

This research is based on the Eclipse technique documentation by zhero-web-sec. The implementation demonstrates both the original Eclipse attack and an enhanced XSS combination variant.

Legal Disclaimer

This code is provided for educational and research purposes only. Users are responsible for ensuring compliance with all applicable laws and obtaining proper authorization before testing. The authors assume no liability for misuse of this software.

Status: Complete Implementation (100% Success Rate)
Last Updated: October 10, 2025
Vulnerability: CVE-2025-32421 + XSS Combined
Framework: Next.js 15.0.4

Download Tool