Next.js Framework React Server Components DoS (CVE-2025-55184)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(279414);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/24");

  script_cve_id("CVE-2025-55184");
  script_xref(name:"IAVA", value:"2025-A-0929-S");

  script_name(english:"Next.js Framework React Server Components DoS (CVE-2025-55184)");

  script_set_attribute(attribute:"synopsis", value:
"The Next.js Framework on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Next.js Framework on the remote host is affected by a denial of service vulnerability:

  - A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0,
  19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel,
  react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads
  from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server
  process and may prevent future HTTP requests from being served. (CVE-2025-55184)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://nextjs.org/blog/security-update-2025-12-11");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Next.js Framework version 14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 15.6.0-canary.60,
16.0.10, 16.1.0-canary.19 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-55184");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/19");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vercel:next.js");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

get_kb_item_or_exit('Host/nodejs/modules/enumerated');

# handle canary builds, e.g. 15.6.0-canary.60
vcf::add_separator('-');
vcf::add_conversions({'canary':-25});

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'next');

var constraints;

if (app_info.version =~ "15(\.\d+)+-canary(\.\d+)+")
  constraints = [{'fixed_version':'15.6.0-canary.60'}];
else if (app_info.version =~ "16(\.\d+)+-canary(\.\d+)+")
  constraints = [{'fixed_version':'16.1.0-canary.19'}];
else
  constraints = [
    {'min_version':'13.3.0', 'fixed_version':'14.2.35'},
    {'min_version':'15.0.0', 'fixed_version':'15.0.7'},
    {'min_version':'15.1.0', 'fixed_version':'15.1.11'},
    {'min_version':'15.2.0', 'fixed_version':'15.2.8'},
    {'min_version':'15.3.0', 'fixed_version':'15.3.8'},
    {'min_version':'15.4.0', 'fixed_version':'15.4.10'},
    {'min_version':'15.5.0', 'fixed_version':'15.5.9'},
    {'min_version':'16.0.0', 'fixed_version':'16.0.10'}
  ];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);