43 matches found
RSC_Detector
Детектор отпечатков RSC Расширение для Chrome, которое обнаруживает отпечатки React Server Components RSC и Next.js App Router на веб-страницах. ⚠️ Важное уведомление Это расширение предназначено только для образовательных целей и исследований в области безопасности. Оно включает функциональность,...
NextRce
NextRce — инструмент эксплуатации RSC в Next.js CVE-2025-55182 Продвинутый сканер и инструмент эксплуатации уязвимостей для Next.js App Router РазработаноMitsec 🔥 Новая возможность: режим обхода WAF UTF-16LE Стандартные полезные нагрузки, содержащие такие ключевые слова, как childprocess или...
react2shell
React2Shell - Эксплойт PoC для CVE-2025-55182 Доказательство концепции эксплойта для CVE-2025-55182 — критической уязвимости удалённого выполнения кода в приложениях Next.js, использующих React Server Components. ⚠️ ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ ЭТОТ ИНСТРУМЕНТ ПРЕДНАЗНАЧЕН ТОЛЬКО ДЛЯ ОБРАЗОВАТЕЛЬНОГО ...
CVE-2025-55182-Exploit-extension
Детектор отпечатков RSC Расширение Chrome для обнаружения отпечатков React Server Components RSC и Next.js App Router на веб-страницах. ⚠️ Важное уведомление Это расширение предназначено только для образовательных целей и исследований в области безопасности. Оно включает функциональность, которая...
CVE-2025-55182-Exploiter
🛡️ RSC Sentinel Pro Расширенный аудитор React Server Components RSC и эксплойт-набор для CVE-2025-55182 🔥 Обнаружение. Идентификация. Эксплуатация. Расширение для Chrome для исследователей безопасности и охотников за багами, нацеленное на уязвимости RSC в Next.js App Router — особенно...
React2Shell
RSC Sentinel Расширение Firefox для обнаружения уязвимостей React2Shell CVE-2025-55182 и CVE-2025-66478 в веб-приложениях. 👁️ Обзор RSC Sentinel — это расширение Firefox для специалистов по безопасности и преподавателей, которые хотят наблюдать индикаторы React Server Components RSC и Next.js App...
RSC-Infra-Scanner
RSC Infra Scanner rscinfrascan.py는 Next.js App Router / React Server ComponentsRSC 인프라로 추정되는 대상을 식별fingerprinting하기 위한 빠른 비동기 Python 도구입니다. 이 도구는 어떤 취약점도 악용하지 않습니다. 영향을 받을 수 있는 기술 계열예: RSC 관련 CVE에 속하는 대상을 식별하는 데 도움이 되도록 수동적 HTTP/HTML/헤더 핑거프린팅 만 수행합니다. 대상 취약점 이 스캐너는 다음 취약점에 노출될 가능성이 있는 인프라를 식별하는 데...
cve-2025-55182-lab
CVE-2025-55182 RSC lab намеренно уязвимый Локальный Docker -лаборатория для авторизованных исследований безопасности: React Server Components / Next.js App Router со стеком в уязвимом диапазоне CVE-2025-55182 React2Shell. Используйте только на своей собственной машине. Не выставляйте этот контейн...
CVE-2025-55182_CVE-2025-66478
CVE-2025-55182 - Esecuzione Remota di Codice nei Server Components di Next.js/React Panoramica Questo repository contiene un exploit Proof-of-Concept PoC per CVE-2025-55182, una vulnerabilità critica di Esecuzione Remota di Codice RCE che interessa i Server Components di React nelle versioni 19.x...
EUVD-2026-49382
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue h...
GHSA-4C39-4CCG-62R3 Next.js: Unbounded Server Action payload in Edge runtime
Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be...
Next.js: Unauthenticated disclosure of internal Server Function endpoints
Impact In Next.js applications using App Router, Server Actions use server or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts for...
GHSA-6GPP-XCG3-4W24 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead...
NPM: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
NPM: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.2.11...
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead...
GHSA-M99W-X7HQ-7VFJ Next.js: Denial of Service in App Router using Server Actions
Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using...
PT-2026-63558
Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Applications using App Router, Server Actions use server, or use cache endpoints may disclose these endpoints, bypassing authentication on the pages...
PT-2026-63556
Name of the Vulnerable Software and Affected Versions Next.js versions 13.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Crafted requests targeting applications using App Router with at least one Server Action can cause excessive CPU usage, which blocks the processing of...
CVE-2026-44575
A flaw was found in Next.js. App Router applications that use middleware or proxy-based authorization checks are vulnerable to unauthorized access. A remote attacker can exploit this by crafting specific .rsc and segment-prefetch URLs, which bypass the intended middleware rules. This allows acces...
