Next.js CVE-2025-66478 PoC

English | 한국어

This repository contains a Proof of Concept (PoC) for reproducing and researching the Next.js CVE-2025-66478 vulnerability. It consists of a vulnerable Next.js application and a Python exploit script to test the vulnerability.

What is CVE-2025-66478?

This is a Remote Code Execution (RCE) vulnerability occurring in the processing of Next.js Server Actions.

Key Highlights:

• Root Cause: Insecure Deserialization within the RSC (React Server Components) Flight protocol.
• Attack Vector: Prototype Pollution via the __proto__ property.

Vulnerability Summary

Item	Description
CVE ID	CVE-2025-66478
Type	Remote Code Execution (RCE)
Root Cause	Insecure Deserialization in RSC Flight Protocol
Severity (CVSS)	10.0 (Critical)
Impact	Arbitrary system command execution on the server

Attack Mechanism (Technical Detail)

1. Payload Transmission: The attacker crafts a payload using the React Flight serialization format, injecting properties like __proto__.
2. Insecure Deserialization & Pollution: The server deserializes the payload without proper validation, leading to pollution of Object.prototype.
3. Thenable Gadget: The pollution injects a then property into all objects. Next.js logic misidentifies these objects as Promises (Thenables).
4. RCE Execution: When the server attempts to await this "fake Promise", the malicious JavaScript code injected into the then method is executed (e.g., child_process.execSync).

sequenceDiagram
    participant Attacker
    participant Server as Next.js Server
    
    Attacker->>Server: POST / (JSON with "__proto__": {"then": ...})
    Note right of Server: JSON Parsing Pollutes Object.prototype
    
    Server->>Server: Application Logic encounters an Object
    
    rect rgb(200, 150, 150)
    Note right of Server: "Thenable" Check Gadget
    Server->>Server: Checks: typeof obj.then === 'function'?
    Server-->>Server: YES (due to pollution)
    end
    
    Server->>Server: Await/Execute malicious .then()
    Note right of Server: Malicious JS Code Runs (RCE)
    
    Server-->>Attacker: Response (Action Redirect / Error info)

Loading

Consequently, as the server processes this manipulated Promise, it executes JavaScript code injected by the attacker, which can lead to system command execution. The included main.py is example code that reproduces this attack scenario.

Affected Versions

This vulnerability affects Next.js applications using the App Router.

• Affected:
  • Next.js 15.x
  • Next.js 16.x
  • Next.js 14.3.0-canary.77 and later (Canary releases)
• Not Affected:
  • Next.js 13.x
  • Next.js 14.x Stable releases
  • Pages Router only applications
  • Edge Runtime

Fixed Versions:

• 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7
• 16.0.7
• 15.6.0-canary.58 (for PPR users)

References

• Next.js Security Advisory
• NVD - CVE-2025-66478

File Structure

• next.js/: Vulnerable Next.js web application example code.
• exploit/: Exploit execution script written in Python (main.py).

Prerequisites

• Node.js: v18 or higher recommended.
• Python: v3.8 or higher recommended.

---

1. Running the Next.js Application

First, you need to run the target Next.js server.

1. Navigate to the next.js directory:

   cd next.js

2. Install dependencies:

   npm install
   # You can also use yarn or pnpm.

3. Start the development server:

   npm run dev

   Verify that you can access http://localhost:3000 via your browser.

2. Running the Python Exploit

Now you can test the vulnerability using the Python script.

1. Navigate to the exploit directory from the project root:

   cd exploit

2. (Optional) Using a Virtual Environment is recommended:

   python3 -m venv venv
   source venv/bin/activate  # For Windows: venv\Scripts\activate

3. Install necessary libraries: The requests module is required.

   pip install requests

4. Run the script:

   python main.py

   By default, it targets the local address (http://localhost:3000). To test a different address, use the --url option:

   python main.py --url http://target-ip:3000

Disclaimer

This code is provided for security research and educational purposes only. Using this tool against systems or networks without prior permission is illegal, and the user is solely responsible for any issues that arise from such use.