Next.js CVE Auto-Patcher

Automation tool written in Go to scan GitHub repositories, detect vulnerable Next.js versions (CVE-2025-66478), and automatically create Pull Requests with the specific security patch.

📋 Prerequisites

Make sure you have the following installed and configured in your environment:

1. Go (1.20 or higher)
2. Git (with SSH keys configured and loaded in the agent)
3. GitHub CLI (gh)

Authentication

Before running the tool, you must be authenticated in the GitHub CLI:

gh auth login
# Select "SSH" as git protocol and "GitHub.com"

🚀 Setup and Installation

1. Clone this repository (where you saved the main.go script):

   root@kitploit:~

   git clone <your-tools-repo-url>
   cd auto-patcher
   

2. Install Go dependencies: We need the semver library for intelligent version comparison.

   root@kitploit:~

   go get github.com/Masterminds/semver/v3
   go mod tidy
   

⚙️ Configuration

Currently, configuration is done directly in the constants of the main.go file. Review these lines before running:

• Target Repo List: In the main function, edit the gh command if you want to limit the search to a specific organization or user:
  root@kitploit:~

  // main.go
  cmd := exec.Command("gh", "repo", "list", "YOUR_ORG_OR_USER", "--limit", "100", ...)
  

• PR Messages:
  root@kitploit:~

  const (
      TargetBranch = "fix/security-nextjs-cve"
      PRTitle      = "fix(deps): upgrade next.js to patch CVE-2025-66478"
  )
  

▶️ Usage

Simply run the main script:

go run main.go

Execution Flow:

1. Lists repositories using gh repo list.
2. Clones each repository into a temporary folder (/tmp/repo-fixer-*).
3. Recursively searches for package.json files.
4. Compares the next version against the security rules table (SemVer).
5. If vulnerable, edits the package.json with the minimum required safe version.
6. Creates a branch, commits, pushes, and opens a Pull Request.

⚠️ Patching Logic (CVE-2025-66478)

The script applies strict rules to avoid breaking compatibility (doesn't update to latest, but to the safe patch of your minor version):

Check nextJsRules in main.go for the complete list.