43 matches found
react2shell
React2Shell - Эксплойт PoC для CVE-2025-55182 Доказательство концепции эксплойта для CVE-2025-55182 — критической уязвимости удалённого выполнения кода в приложениях Next.js, использующих React Server Components. ⚠️ ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ ЭТОТ ИНСТРУМЕНТ ПРЕДНАЗНАЧЕН ТОЛЬКО ДЛЯ ОБРАЗОВАТЕЛЬНОГО ...
RSC_Detector
Детектор отпечатков RSC Расширение для Chrome, которое обнаруживает отпечатки React Server Components RSC и Next.js App Router на веб-страницах. ⚠️ Важное уведомление Это расширение предназначено только для образовательных целей и исследований в области безопасности. Оно включает функциональность,...
NextRce
NextRce — инструмент эксплуатации RSC в Next.js CVE-2025-55182 Продвинутый сканер и инструмент эксплуатации уязвимостей для Next.js App Router РазработаноMitsec 🔥 Новая возможность: режим обхода WAF UTF-16LE Стандартные полезные нагрузки, содержащие такие ключевые слова, как childprocess или...
CVE-2025-55182-Exploiter
🛡️ RSC Sentinel Pro Auditeur avancé des composants serveur React RSC et boîte à outils d'exploitation CVE-2025-55182 🔥 Détecter. Empreinte. Exploiter. Une extension Chrome pour les chercheurs en sécurité et les chasseurs de bugs ciblant les vulnérabilités RSC de Next.js App Router — en particulier...
CVE-2025-55182-Exploit-extension
Détecteur d'empreintes RSC Une extension Chrome pour détecter les empreintes des React Server Components RSC et du Next.js App Router sur les pages web. ⚠️ Avis important Cette extension est destinée uniquement à des fins éducatives et de recherche en sécurité. Elle inclut des fonctionnalités...
RSC-Infra-Scanner
RSC Infra Scanner rscinfrascan.py est un outil Python rapide et asynchrone qui effectue l'empreinte de domaines pour identifier une infrastructure probable Next.js App Router / React Server Components RSC. Il n'exploite aucune vulnérabilité. Il effectue uniquement un fingerprinting passif...
cve-2025-55182-lab
CVE-2025-55182 RSC lab намеренно уязвимый Локальный Docker -лаборатория для авторизованных исследований безопасности: React Server Components / Next.js App Router со стеком в уязвимом диапазоне CVE-2025-55182 React2Shell. Используйте только на своей собственной машине. Не выставляйте этот контейн...
React2Shell
RSC Sentinel React2Shell कमजोरियों CVE-2025-55182 और CVE-2025-66478 का पता लगाने के लिए एक Firefox एक्सटेंशन। 👁️ अवलोकन RSC Sentinel एक Firefox ब्राउज़र एक्सटेंशन है जो सुरक्षा शोधकर्ताओं और शिक्षकों के लिए बनाया गया है जो ब्राउज़िंग करते समय React Server Components RSC और Next.js App Router...
CVE-2025-55182_CVE-2025-66478
CVE-2025-55182 - Esecuzione Remota di Codice nei Server Components di Next.js/React Panoramica Questo repository contiene un exploit Proof-of-Concept PoC per CVE-2025-55182, una vulnerabilità critica di Esecuzione Remota di Codice RCE che interessa i Server Components di React nelle versioni 19.x...
EUVD-2026-49382
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue h...
GHSA-4C39-4CCG-62R3 Next.js: Unbounded Server Action payload in Edge runtime
Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be...
Next.js: Unauthenticated disclosure of internal Server Function endpoints
Impact In Next.js applications using App Router, Server Actions use server or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts for...
GHSA-6GPP-XCG3-4W24 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead...
NPM: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
NPM: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.2.11...
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead...
GHSA-M99W-X7HQ-7VFJ Next.js: Denial of Service in App Router using Server Actions
Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using...
PT-2026-63558
Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Applications using App Router, Server Actions use server, or use cache endpoints may disclose these endpoints, bypassing authentication on the pages...
PT-2026-63556
Name of the Vulnerable Software and Affected Versions Next.js versions 13.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Crafted requests targeting applications using App Router with at least one Server Action can cause excessive CPU usage, which blocks the processing of...
CVE-2026-44575
A flaw was found in Next.js. App Router applications that use middleware or proxy-based authorization checks are vulnerable to unauthorized access. A remote attacker can exploit this by crafting specific .rsc and segment-prefetch URLs, which bypass the intended middleware rules. This allows acces...
