New Scanner Tool for Detecting Exposed ReactJS and Next.js RSC Endpoints (CVE-2025-55182)
A new security assessment tool has been released to help researchers and administrators identify React Server Components (RSC) endpoints potentially exposed to CVE-2025-55182 .
A new security assessment tool has been released to help researchers and administrators identify React Server Components (RSC) endpoints potentially exposed to CVE-2025-55182 .
Developed as a lightweight, non-intrusive Python script by Pentester Fatguru, the scanner offers a method for "Surface Detection" that avoids aggressive proof-of-concept (PoC) exploits. These PoCs often fail in production environments due to code minification and tree-shaking.
CVE-2025-55182 is a critical vulnerability in the Next.js framework, specifically affecting how Server Actions handle serialized data. While the vulnerability can lead to Remote Code Execution (RCE), verifying its presence has proven difficult for security teams.
Existing PoCs often attempt to inject rigid payloads, such as vm#runInThisContext , or rely on default module IDs like {"id":"vm"} . In production builds using Webpack or Turbopack, module IDs are typically minified into integers (e.g., 742) or short strings, causing standard RCE attempts to fail.
The newly released scanner addresses this detection gap by validating the attack surface rather than attempting to deploy a specific exploit gadget. Instead of sending a malicious payload, the tool checks if the target server exposes the RSC protocol, indicated by the Content-Type: text/x-component header, and accepts specific Next.js action headers.
These PoCs often fail in production environments due to code minification and tree-shaking.
This approach confirms that the vulnerability pathway is open without needing to identify the correct minified module ID or disrupt server operations. For security professionals, a positive result from this scanner indicates that the endpoint is reachable and processing potentially dangerous input.
The tool’s documentation advises that if the scanner flags a target, further manual validation is required to prove RCE. This would involve enumerating or fuzzing the Webpack Module ID or analyzing client-side assets like webpack-runtime.js .
The tool is designed for ease of use and integration into existing workflows. It supports single-target scanning via command line arguments and bulk scanning through list input, outputting results to a CSV file for reporting. Prerequisites for running the tool are minimal, requiring only Python 3 and standard library dependencies.
This release provides organizations running Next.js applications with the capability to audit their exposure to CVE-2025-55182 effectively before attackers can reverse-engineer production builds to craft working exploits.
Upgrade Immediately: Update to the latest patched versions (e.g., Next.js 15.0.5+, 15.1.9+, or 16.0.7+). Verify Exposure: Use the scanner to audit your external attack surface and confirm that no unpatched endpoints remain accessible. Download the Tool: Security teams can access the scanner and full documentation at the official repository.
Based on reporting by Cyber Security News.