New Scanner Released to Detect Exposed ReactJS and Next.js RSC Endpoints (CVE-2025-55182)

Security researchers have developed a specialized scanning tool designed to identify vulnerable React Server Component (RSC) endpoints in modern web applications. This tool addresses a significant gap in the detection of CVE-2025-55182.

The newly available Python-based scanner introduces an advanced surface detection methodology for assessing exposure to CVE-2025-55182. Unlike conventional exploitation tools that rely on rigid payload injection, this scanner verifies if servers expose the RSC protocol and respond to Next.js action headers.

The CVE-2025-55182 vulnerability affects React 19 and Next.js applications, potentially leaving them open to remote code execution attacks through exposed RSC endpoints. Existing detection methods often yield false negatives, making accurate vulnerability assessment challenging for security teams.

Traditional vulnerability scanning approaches have limitations in production environments. Many proof-of-concept tools use specific payloads or assume default module identifiers, which can be ineffective due to production build practices like module identifier minification or tree-shaking.

The new scanner focuses on surface detection rather than exploitation. It verifies if servers accept RSC protocol requests and process Next.js action headers, identifying exposure rather than confirm exploitability.

For organizations receiving positive detection results, this indicates that their servers are accepting RSC payloads, signaling potential vulnerability. Further investigation is required for actual exploitation validation, as rigid payloads may fail against production systems due to minified module identifiers.

Organizations must analyze client-side files and chunk assets to extract valid ID mappings for potential gadgets. The scanner provides command-line functionality, allowing users to scan individual targets or process multiple URLs for bulk assessment. It requires Python 3 and standard dependencies available via pip.

This tool strictly identifies exposed RSC endpoints without executing exploits, serving as a detection and awareness mechanism. It alerts organizations to check if their applications accept RSC payloads needing processing.

The scanner contributes to vulnerability discovery workflows, assisting teams in identifying at-risk React and Next.js applications before potential attacks occur.

Based on reporting by GBHackers.