📦 Packages Scanned

🚀 Quick Start

Prerequisites

• Node.js 16 or higher
• npm or yarn

Installation

1. Clone this repository or download check.js:

2. Navigate to your React/Next.js project directory:

3. Run the scanner:

Alternative: Direct Usage

You can also copy check.js directly into your project and run:

📋 Sample Output

📖 Understanding the Results

Risk Levels

Status Indicators

🔧 Patched Versions

React (CVE-2025-55182)

Next.js (CVE-2025-66478)

Not Affected

The following configurations are NOT affected by these vulnerabilities:

• Next.js 13.x and earlier
• Next.js 14.x stable releases
• Applications using only the Pages Router
• Applications running on Edge Runtime
• React 18.x and earlier (no RSC support)

🛡️ About the Vulnerabilities

CVE-2025-55182 (React)

Severity: CRITICAL (CVSS 10.0)

Affected Packages:

• react-server-dom-webpack
• react-server-dom-parcel
• react-server-dom-turbopack

Vulnerability Type: Insecure Deserialization

Description: A critical Remote Code Execution (RCE) vulnerability exists in the react-server package, which is integral to React Server Components (RSC). The flaw stems from an insecure deserialization vulnerability within the RSC "Flight" protocol.

The vulnerability allows an unauthenticated attacker to achieve remote code execution on the server by sending a specially crafted HTTP request to any Server Function endpoint. Even applications that do not explicitly implement React Server Function endpoints may be vulnerable if they support React Server Components, as the vulnerability affects default configurations.

Attack Vector:

• Attacker sends a specially crafted HTTP request to the server
• The React Flight protocol processes and deserializes RSC payloads in an unsafe manner
• Malicious input triggers arbitrary code execution on the server
• Proof-of-concepts have shown near-100% reliability against default configurations

Impact:

• Full server compromise
• Data exfiltration
• Access to environment variables and secrets
• Malware installation
• Lateral movement within infrastructure

References:

• CVE-2025-55182 Official Record
• React Security Bulletin (December 3, 2025)

CVE-2025-66478 (Next.js)

Severity: CRITICAL (CVSS 10.0)

Affected Package: next

Vulnerability Type: Insecure Deserialization (inherited from React RSC)

Description: A critical Remote Code Execution vulnerability in Next.js affects applications using the App Router with React Server Components. This vulnerability is the downstream manifestation of CVE-2025-55182, as Next.js inherits the flaw through its implementation of the React Flight protocol.

The vulnerability allows unauthenticated attackers to execute arbitrary code on affected servers by sending specially crafted HTTP requests that exploit the unsafe processing of RSC payloads.

Attack Vector:

• Targets server-side processing of RSC payloads
• Attackers craft malicious requests exploiting the Flight protocol
• When processed by the Next.js server, results in arbitrary code execution
• No authentication required

Impact:

• Complete server takeover
• Access to environment variables and secrets
• Database access and manipulation
• Ability to modify application behavior
• Full infrastructure compromise

References:

• CVE-2025-66478 Official Record
• Next.js Security Advisory

⚠️ Other Impacted Frameworks

The React Flight protocol vulnerability affects any framework or bundler that implements React Server Components. If your project uses any of the following, you should verify your React packages are patched:

Key Takeaway

Any application using React Server Components is potentially vulnerable. The core vulnerability exists in React's RSC implementation, so regardless of which framework you use, you must update the React packages (react, react-dom, react-server-dom-*) to the patched versions.

☁️ Cloud Provider WAF Protections

Major cloud providers have proactively deployed Web Application Firewall (WAF) rules to protect against these vulnerabilities. However, WAF protection is a temporary measure and does NOT eliminate the need to patch your applications.

Cloudflare

Cloudflare has deployed new WAF rules to automatically block exploitation attempts for CVE-2025-55182. All customers whose React application traffic is proxied through Cloudflare are automatically protected.

To verify protection:

1. Log in to Cloudflare Dashboard
2. Navigate to Security → WAF → Managed Rules
3. Ensure rules are enabled and updated

Amazon Web Services (AWS)

AWS has integrated updated rules for CVE-2025-55182 into the default version (1.24) of the AWS WAF managed rule set.

To enable protection:

Custom Rule Option: For immediate protection, you can deploy custom AWS WAF rules to detect and prevent exploitation attempts:

Note: Managed AWS services are generally not affected, but applications running vulnerable React/Next.js versions in your own environment should be updated immediately.

Microsoft Azure

Azure WAF with the latest Default Rule Set (DRS) 2.1 can detect some attempts to exploit this vulnerability.

To enable protection:

1. Navigate to Azure Portal → Application Gateway or Front Door
2. Go to WAF policy → Managed Rules
3. Ensure DRS 2.1 is selected
4. Optionally create custom rules for additional protection

Custom Rule Example: Organizations can create custom WAF rules specifically tailored to block the exploit pattern. Azure recommends validating custom rules in a test environment before production deployment.

Google Cloud Platform (GCP)

Google Cloud Armor provides protection through its preconfigured WAF rules and can be configured with custom security policies.

To enable protection:

1. Navigate to Google Cloud Console → Network Security → Cloud Armor
2. Create or update security policy
3. Enable preconfigured WAF rules for known vulnerabilities
4. Apply policy to backend services

Vercel

Vercel has implemented platform-level mitigations to protect hosted applications. However, Vercel strongly recommends updating to the patched versions of Next.js.

Important WAF Considerations

⚠️ WAF protection is a temporary measure. All cloud providers emphasize that:

1. WAFs do not fix the vulnerability - They only block known exploit patterns
2. Attackers may bypass WAFs - New exploit variants could evade detection
3. Patching is mandatory - Update to fixed versions immediately
4. Rebuild applications - After upgrading, rebuild to ensure patched dependencies are used

🔒 How to Patch

Quick Fix

Run the following commands in your project directory:

Verification

After updating, run the scanner again to confirm all vulnerabilities are patched:

Expected output should show:

Additional Security Recommendations

1. Rebuild Applications - After upgrading, rebuild to ensure patched dependencies are used
2. Validate Third-Party Dependencies - Check frameworks and bundlers that might bundle vulnerable React packages
3. Implement Defense-in-Depth:
   • Runtime sandboxing for server-side JavaScript
   • Strict routing for RSC endpoints
   • Continuous monitoring for suspicious activity
4. Restrict Public Access - If immediate patching is not possible, restrict access to RSC-enabled endpoints

🔍 Timeline & Discovery

📚 Additional Resources

Official Advisories

• React Security Bulletin (December 3, 2025)
• Next.js Security Advisory
• GitHub Advisory Database

CVE Records

• NIST NVD - CVE-2025-55182
• NIST NVD - CVE-2025-66478

Cloud Provider Documentation

• Cloudflare WAF - React RCE Protection
• AWS WAF Managed Rules
• Azure WAF Documentation
• Google Cloud Armor

Security Analysis

• Wiz Research - React RSC Vulnerability Analysis
• Palo Alto Networks - Threat Brief
• Snyk Vulnerability Database

📄 License

MIT License - See LICENSE for details.

Stay secure! 🔐