next-cve-2025-66478

NextJS CVE-2025-66478 Сканирует все проекты, уязвимые для CVE-2025-66478, в текущей рабочей директории и сообщает о них. Узнайте больше о CVE-2025-66478 Предупреждение Этот скрипт не исправляет никакие уязвимости. Он только их находит. Пожалуйста, обратитесь к этой статье, чтобы узнать больше об...

Nextjs <2.4.1 - Local File Inclusion

ZEIT Next.js before 2.4.1 is susceptible to local file inclusion via the /next and /static request namespace, allowing attackers to obtain sensitive information. id: CVE-2017-16877 info: name: Nextjs 2.4.1 - Local File Inclusion author: pikpikcu severity: high description: ZEIT Next.js before 2.4...

ROOT-APP-NPM-CVE-2025-55173 CVE-2025-55173 in next - Patched by Root

Root has patched CVE-2025-55173 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-57752 CVE-2025-57752 in next - Patched by Root

Root has patched CVE-2025-57752 in the next package for Root:npm. Multiple fixed versions available...

Next.js Middleware Bypass

Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2. The vulnerability allows attackers to bypass middleware security controls by sending a specially crafted 'x-middleware-subrequest' header, which can lead to authorization bypass and other securit...

ROOT-APP-NPM-CVE-2025-57822 CVE-2025-57822 in next - Patched by Root

Root has patched CVE-2025-57822 in the next package for Root:npm. Multiple fixed versions available...

nextploiter

nextploiter Инструмент эксплуатации для NextJS Использование Команды Использование root@kitploit: $ npm install -g nextploiter $ nextploiter COMMAND running command... $ nextploiter --version nextploiter/1.0.0 darwin-arm64 node-v24.12.0 $ nextploiter --help COMMAND USAGE $ nextploiter COMMAND...

test-cve-2025-29927

Тестовое приложение для эксплуатации CVE-2025-29927 Приложение NextJS использует аутентификацию на основе cookie и middleware для предотвращения несанкционированного доступа к странице /admin. Для запуска приложения выполните: root@kitploit: yarn затем yarn dev Для получения несанкционированного...

CVE-2025-55182-exploit

⚠️ ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ Этот инструмент предназначен ТОЛЬКО для авторизованного тестирования безопасности и образовательных целей. Тестируйте только системы, которые вам принадлежат или на которые у вас есть явное письменное разрешение. Несанкционированное использование незаконно и неэтично...

check-cve-2025-66478

Check for CVE-2025-66478 Checks if your NextJS server is vulnerable to CVE-2025-66478. This is just a quick and dirty wrapper for the HTTP request provided by Searchlight. By relying on this script, you are assuming that their research is a valid indcator of vulnerability. Usage root@kitploit:...

React Server Components - Remote Code Execution

React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting...

Exploit for Deserialization of Untrusted Data in Facebook React

Docker Lab & PoC Validation: React2Shell CVE-2025-55182...

Linux Distros Unpatched Vulnerability : CVE-2026-64642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using...

Linux Distros Unpatched Vulnerability : CVE-2026-64641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting...

Linux Distros Unpatched Vulnerability : CVE-2026-64644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js...

CVE-2026-64647

A flaw was found in Next.js. This vulnerability allows a remote attacker to potentially access confidential data. When a server-side fetch processes a request with a body using a non-UTF-8 character set, it may incorrectly return a cached response body from a different request to the same URL but...

CVE-2026-64649 Next.js: Server-Side Request Forgery in Server Actions on Custom Servers

Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forger...

CVE-2026-64646 Next.js: Unbounded Server Action payload in Edge runtime

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the...

CVE-2026-64641

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further...

CVE-2026-64643

CVE-2026-64643 affects Next.js (versions 12.0.0–15.5.20 and 16.0.0–16.2.10) where apps using App Router, Server Actions (use server) or cache endpoints can disclose internal Server Action IDs and endpoints to unauthenticated users via publicly served client artifacts. This disclosure allows unaut...