kimtruth/cve-2025-55183-pocPoC for CVE-2025-55183
This repository contains detection tooling for a source code disclosure vulnerability
in Next.js React Server Components (RSC) / Server Actions, tracked as
CVE-2025-55183.
In vulnerable applications, a crafted HTTP request to a Server Function can cause the server to return the full JavaScript source code of that function when the reference is stringified (for example, via template literals or implicit coercion in database queries).
React's fix adds a toString() override for server references that returns a
constant placeholder string instead of the real function body. Applications
running older builds may still leak source code if server references are
directly or indirectly stringified and reflected back to the client.
⚠️ Legal notice:
These tools are for security testing and research on systems you own or are explicitly authorized to test. Unauthorized scanning or exploitation may be illegal.
CVE-2025-55183.yaml_next/static/chunks/*.js filesID: CVE-2025-55183
Component: React Server Components / Server Actions in Next.js apps
Impact: Server-side JavaScript source code disclosure
Root cause:
Server references (Server Functions) did not override toString(). When such
a reference was passed as an argument to code that coerced it to a string, its
full source code could be returned to the client (for example, via an error
path, logging, or query-building logic).
Fix (upstream):
React now installs a toString descriptor on server references that returns a
constant placeholder such as:
function () { [omitted code] }
This prevents real function bodies from being exposed even if stringified.
For details on the underlying React changes, see:
894bc73cb493487c48d57f4508e6278db58e673a