namest504/cve-2025-66478-exploit-pocProof-of-concept exploit for Next.js CVE-2025-66478, demonstrating RCE via insecure deserialization and prototype pollution in Server Actions. Includes vulnerable app and Python exploit script for security research.
This repository contains a Proof of Concept (PoC) for reproducing and researching the Next.js CVE-2025-66478 vulnerability. It consists of a vulnerable Next.js application and a Python exploit script to test the vulnerability.
This is a Remote Code Execution (RCE) vulnerability occurring in the processing of Next.js Server Actions.
Key Highlights:
__proto__ property.| Item | Description |
|---|
| CVE ID | CVE-2025-66478 |
| Type | Remote Code Execution (RCE) |
| Root Cause | Insecure Deserialization in RSC Flight Protocol |
| Severity (CVSS) | 10.0 (Critical) |
| Impact | Arbitrary system command execution on the server |
__proto__.Object.prototype.then property into all objects. Next.js logic misidentifies these objects as Promises (Thenables).await this "fake Promise", the malicious JavaScript code injected into the then method is executed (e.g., child_process.execSync).sequenceDiagram
participant Attacker
participant Server as Next.js Server
Attacker->>Server: POST / (JSON with "__proto__": {"then": ...})
Note right of Server: JSON Parsing Pollutes Object.prototype
Server->>Server: Application Logic encounters an Object
rect rgb(200, 150, 150)
Note right of Server: "Thenable" Check Gadget
Server->>Server: Checks: typeof obj.then === 'function'?
Server-->>Server: YES (due to pollution)
end
Server->>Server: Await/Execute malicious .then()
Note right of Server: Malicious JS Code Runs (RCE)
Server-->>Attacker: Response (Action Redirect / Error info)Consequently, as the server processes this manipulated Promise, it executes JavaScript code injected by the attacker, which can lead to system command execution. The included main.py is example code that reproduces this attack scenario.
This vulnerability affects Next.js applications using the App Router.
Fixed Versions:
next.js/: Vulnerable Next.js web application example code.exploit/: Exploit execution script written in Python (main.py).First, you need to run the target Next.js server.
Navigate to the next.js directory:
cd next.js
Install dependencies:
npm install
# You can also use yarn or pnpm.
Start the development server:
npm run dev
Verify that you can access http://localhost:3000 via your browser.
Now you can test the vulnerability using the Python script.
Navigate to the exploit directory from the project root:
cd exploit
(Optional) Using a Virtual Environment is recommended:
python3 -m venv venv
source venv/bin/activate # For Windows: venv\Scripts\activate
Install necessary libraries:
The requests module is required.
pip install requests
Run the script:
python main.py
By default, it targets the local address (http://localhost:3000). To test a different address, use the --url option:
python main.py --url http://target-ip:3000
This code is provided for security research and educational purposes only. Using this tool against systems or networks without prior permission is illegal, and the user is solely responsible for any issues that arise from such use.