Installation

Requirements

• Python 3.9 or higher
• pip package manager

Install Dependencies

Or install manually:

Usage

Basic Scanning

Scan a single URL:

Scan multiple hosts from a file:

Advanced Options

Scan with custom paths:

Scan with paths from file:

Custom headers:

Multi-threaded scanning:

Export results to JSON:

Export all results (including non-vulnerable):

Output Control

Verbose mode (show details for all hosts):

Quiet mode (only show vulnerable hosts):

Disable colors:

Input File Formats

Hosts File (hosts.txt)

One host per line. Lines starting with # are ignored.

Paths File (paths.txt)

One path per line. Paths will be automatically prefixed with / if not present.

Command-Line Options

Detection Logic

Safe Side-Channel Detection

The scanner uses a non-invasive detection method that:

• Sends a specially crafted, non-malicious multipart form data payload
• Triggers error responses in vulnerable RSC (React Server Components) parsing
• Looks for multiple vulnerability indicators:

Detection Patterns

1. JavaScript Error Messages

   • SyntaxError - Indicates improper JSON parsing of form data
   • Unexpected token - Suggests vulnerable RSC deserialization
   • ReferenceError / TypeError - Reveals unsafe object property access

2. RSC-Specific Error Responses

   • HTTP 500 status code with text/x-component content type
   • RSC headers present (Vary: RSC, Next-Router-State-Tree)
   • Error digest in response body (e.g., {"digest":"..."})
   • RSC payload indicators ($@, error objects)

The scanner detects both verbose error messages (older versions) and structured RSC error responses (newer versions), ensuring comprehensive coverage across different Next.js implementations.

Important: This method does NOT execute any code on the target system. It only detects whether the system is vulnerable by observing error responses.

Example Workflows

Quick Check for Single Application

Comprehensive Organization Scan

Scanning Multiple Paths

Scanning with Authentication Headers

Interpreting Results

Vulnerable Status

The scanner will mark a host as VULNERABLE if it detects:

• Syntax errors indicating vulnerable RSC parsing
• Unexpected token errors in form data processing
• Reference or type errors revealing unsafe property access
• HTTP 500 errors with RSC-specific headers and content
• Error digests in RSC response format
• Characteristic error patterns from vulnerable Next.js/RSC implementations

What Does "Vulnerable" Mean?

When the scanner detects a vulnerability, it means:

1. The server is processing malformed RSC payloads - It's accepting and attempting to parse specially crafted form data as React Server Components
2. Improper input validation - The application doesn't properly validate multipart form data before processing
3. Potential for RCE - In vulnerable configurations, attackers can exploit this to achieve remote code execution
4. Prototype pollution vectors - The parsing weakness can be leveraged for prototype pollution attacks

Risk Level

• CRITICAL: Servers showing RSC error responses are actively processing malicious payloads
• Impact: Remote code execution, data theft, server compromise
• Exploitability: Publicly known exploits exist

Exit Codes

• 0: No vulnerabilities found
• 1: One or more vulnerabilities detected

Security Considerations

1. Permission: Only scan systems you own or have explicit permission to test
2. Safe Detection: This scanner only uses safe side-channel detection and never executes code
3. Rate Limiting: Adjust thread count (-t) to avoid overwhelming targets
4. SSL Verification: Keep SSL verification enabled unless necessary for testing
5. Production Safe: The scanner is designed to be safe for use on production systems

Mitigation

If your application is found vulnerable:

1. Immediate Actions:

   • Update Next.js to the latest patched version
   • Review and update all React Server Components
   • Implement input validation for form data

2. Long-term Security:

   • Enable WAF rules to block suspicious multipart payloads
   • Monitor for unusual server action requests
   • Implement security headers
   • Regular security audits

3. References:

   • CVE-2025-55182
   • CVE-2025-66478

Disclaimer

This tool is for authorized security testing only. Unauthorized access to computer systems is illegal. The authors are not responsible for misuse or damage caused by this program.