Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
nextjs-cve-version-confusion — Reproduction for Next.js CVE-2025-55182 version string confusion issue | Kitploit
Tools/GitHubGitHub/sponte/nextjs-cve-version-confusion
Vulnerability AnalysisWeb SecurityLearning & EducationCurated Resources
GitHubsponte/nextjs-cve-version-confusion

nextjs-cve-version-confusion

Reproduction for Next.js CVE-2025-55182 version string confusion issue

View Repository
9 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Next.js CVE-2025-55182 Version Confusion Reproduction

This repository demonstrates the version string discrepancy in Next.js 16.0.7+ that causes confusion when verifying CVE-2025-55182 patch status.

The Issue

After upgrading to Next.js 16.0.8, users checking their React version see 19.3.0-canary-52684925-20251110 in React DevTools, which appears to be the OLD vulnerable version. However, the actual CVE fix IS present in the react-server-dom-* packages.

To Reproduce

  1. Install dependencies:

    root@kitploit:~
    npm install

  2. Run the version check script:

    root@kitploit:~
    npm run check-versions

  3. Or start the dev server and check React DevTools:

    root@kitploit:~
    npm run dev

    Then open DevTools console and run:

    root@kitploit:~
__REACT_DEVTOOLS_GLOBAL_HOOK__.renderers.values().next()["value"]["version"]

Expected Output

The check-versions script will show:

  • react-server-dom-turbopack uses 19.3.0-canary-709fe18f-20251202 ✅ (fixed)
  • react-server-dom-webpack uses 19.3.0-canary-709fe18f-20251202 ✅ (fixed)
  • react-dom exports version 19.3.0-canary-52684925-20251110 ⚠️ (old string)
  • react exports version 19.3.0-canary-52684925-20251110 ⚠️ (old string)

The security fix (hasOwnProperty.call(moduleExports, metadata[2])) IS present, but the version strings are inconsistent.

Why This Matters

Security teams and developers verifying CVE-2025-55182 remediation will see the old version string and incorrectly believe their systems are still vulnerable. This creates unnecessary confusion and potential false alarms in security audits.

Download Tool