CVE-2025-55182-Scanner

CVE‑2025‑55182 – Next.js RSC Deserialization RCE Scanner This tool checks whether a target is vulnerable to CVE‑2025‑55182 , a Remote Code Execution bug caused by unsafe handling of RSC React Server Components model payloads inside Next.js. The vulnerability chains Prototype Pollution →...

Next.js has a Cache poisoning vulnerability due to omission of the Vary header

Summary A cache poisoning issue in Next.js App Router =15.3.0 and 15.3.3 may have allowed RSC payloads to be cached and served in place of HTML, under specific conditions involving middleware and redirects. This issue has been fixed in Next.js 15.3.3. Users on affected versions should upgrade...