CVE-2025-29927

CVE-2025-29927: Next.js Middleware Bypass Vulnerability This repository demonstrates the CVE-2025-29927 vulnerability in Next.js where the internal header x-middleware-subrequest can be used to bypass middleware checks like authentication. Vulnerability Details Next.js uses an internal header...

RSC_Detector

RSC Fingerprint Detector A Chrome extension for detecting React Server Components RSC and Next.js App Router fingerprints on web pages. ⚠️ Important Notice This extension is designed for educational and security research purposes only. It includes functionality that could be used to test for...

react2shell-interactive

React2Shell - CVE-2025-55182 Interactive PoC Interactive shell for exploiting CVE-2025-55182, a Remote Code Execution vulnerability in React Server Components. Disclaimer This tool is provided for EDUCATIONAL and AUTHORIZED SECURITY TESTING purposes only. Only use on systems you own or have...

POC-CVE-2025-29927

CVE-2025-29927: Next.js Middleware Bypass PoC Overview This PoC demonstrates CVE-2025-29927, a vulnerability in Next.js middleware that allows attackers to bypass authentication, authorization, and CSP mechanisms using the x-middleware-subrequest header. Affected Versions Next.js versions 11.1.4 ...

react2shell-rce-autobot

🔍 React2Shell Dork Scanner 🚨 About the Vulnerability React2Shell is a critical Remote Code Execution RCE vulnerability that affects: Target| Versi Vulnerable ---|--- ⚛️ react-server-dom-webpack| 19.0.0, 19.1.0, 19.1.1, 19.2.0 ⚛️ react-server-dom-turbopack| 19.0.0, 19.1.0, 19.1.1, 19.2.0 ⚛️...

cve-2025-55182-poc

CVE-2025-55182 React2Shell Vulnerability Analysis Lab This repository contains a complete environment for analyzing and reproducing CVE-2025-55182 , a critical Remote Code Execution RCE vulnerability in React Server Components RSC affecting React 19.x and Next.js 15.x. ⚠️ WARNING: This project...

scanner-for-CVE-2025-55182-vulnerability

🛡️ GitHub Vulnerability Scanner for CVE-2025-55182 React/Next.js RCE This Python script is designed to scan all your public and private GitHub repositories for dependencies that are potentially vulnerable to CVE-2025-55182 a critical Remote Code Execution affecting specific versions of React Serve...

CVE-2025-29927-PoC

CVE-2025-29927: Next.js Middleware Bypass Vulnerability PoC This repository demonstrates the CVE-2025-29927 vulnerability in Next.js, where the internal header x-middleware-subrequest can be used to bypass middleware checks like authentication. Affected Versions Next.js 15.x 15.2.3 Next.js 14.x...

CVE-2025-55182

CVE-2025-55182 Next.js Prototype Pollution CVE-2025-55182 is a critical prototype pollution vulnerability in nextjs that allows rce via improper input sanitization in the framework's request handling mechanism, this whole thing happens because nextjs is out here trusting JSON objects like a...

React2Shell-PoC

React2Shell-PoC A proof-of-concept exploit for CVE-2025-55182 and CVE-2025-66478 , critical Remote Code Execution vulnerabilities in React Server Components RSC and Next.js applications. Overview React2Shell demonstrates the exploitation of unsafe deserialization in Next.js server action handlers...

React2P4IM0Nshell

React2P4IM0Nshell 💥Extension Tool for Advanced RCE/Source Leak/Dos CVE-2025-55182/83/84 Auditing and Exploitation for Next.js and React Server Components RSC environments directly from your browser, with built-in linux terminal in the extension to receive any reverse shell ❌ ⚡ CMDCENTER: The Core...

FiberBreak

FiberBreak Exploitation framework for CVE-2025-55182 React2Shell - Critical RCE vulnerability in React Server Components. Overview CVE : CVE-2025-55182 CVSS : 10.0 CRITICAL Type : Remote Code Execution RCE Affected : React 19.0.0-rc.0 to 19.0.0, Next.js 15.0.0 to 15.0.3 Discovery : Lachlan Miller...

cve-2025-55182

CVE-2025-55182 aka React2Shell Setup test enviornment kiot :: /react2shell » docker compose build --no-cache kiot :: /react2shell » docker compose up POC Payload 1. RCE with response in body POST / HTTP/1.1 Host: localhost:3000 Next-Action: whatever Content-Type: multipart/form-data;...

NextRce

NextRce - Next.js RSC Exploit Tool CVE-2025-55182 Advanced Vulnerability Scanner & Exploiter for Next.js App Router Developed byMitsec 🔥 New Feature: WAF Bypass Mode UTF-16LE Standard payloads containing keywords like childprocess or execSync are often blocked by Web Application Firewalls WAFs...

CVE-2025-29927

CVE-2025-29927 Reproduction and fix of the CVE-2025-29927 vulnerability. git clone [email protected]:Bongni/CVE-2025-29927.git cd CVE-2025-29927 In vulnerable/ there is a version of the application that is vulnerable to the attack. In fixed/ there is a version of the application that is...

Vuln-Next.js-CVE-2025-29927

npx [email protected] Install packages npm install -D @types/bcrypt npm install mysql2 npm install jose npm install -D @types/jsonwebtoken Prepare DB CREATE TABLE users id INT PRIMARY KEY AUTOINCREMENT, username VARCHAR255 UNIQUE NOT NULL, password VARCHAR255 NOT NULL ; Run npm run dev...

Next.js_exploit_CVE-2024-34351

csr-rsc-ssg-isr-ssr-ssrf This repo can be used as support to present one or more meetups. The path is as follows... "CSR" Client Side Rendering: React as a standard SPA library "RSC" React Server Components: execution of React components only on the server side "SSG" Static Site Generation:...

CVE-2025-55182-advanced-scanner-

CVE-2025-55182 Scanner Simple command-line tool for detecting and exploiting CVE-2025-55182 React Server Components RCE in Next.js applications. Installation chmod +x scanner.sh Usage Scan with default command id ./scanner.sh -d example.com Execute custom command ./scanner.sh -d example.com -c...

CVE-2025-32421

CVE-2025-32421 Eclipse Technique Lab Comprehensive demonstration of CVE-2025-32421 Eclipse technique - a sophisticated race condition attack against Next.js 15.0.4 that bypasses the original CVE-2024-46982 patch. WARNING - EDUCATIONAL PURPOSE ONLY This laboratory is designed exclusively for:...

Quickcheck-CVE-2025-55182-React-and-CVE-2025-66478-Next.js

GitHub CVE Scanner 🔍 Quickly scan GitHub repositories for critical React and Next.js RSC vulnerabilities Overview A browser-based scanner that checks all GitHub repositories for known security vulnerabilities in React Server Components: CVE| Packages| Severity| Description ---|---|---|---...