Listen to this Post
The vulnerability, CVE-2025-55182, stems from insecure deserialization within the React Server Components flight protocol implementation. When Next.js with the App Router handles serialized React element trees (“Flight” data), it uses `JSON.parse` and subsequent processing to reconstruct React components and their props on the server. A flaw in this process allows maliciously crafted Flight payloads to bypass input sanitization and validation. An attacker can inject a payload where prop values are crafted as object literals with a `toString` property containing executable JavaScript code. During the server-side reconciliation and rendering process, when the vulnerable code attempts to coerce this object to a string, it inadvertently executes the attacker-defined `toString` function. This execution occurs within the server context, leading to arbitrary code execution on the host processing the Next.js request, effectively granting remote control.
Platform: Next.js (App Router)
Version: 15.0.0 – 16.0.6
Vulnerability: Remote Code Execution
Severity: Critical
Date: Dec 3, 2025
Prediction: Patched Dec 2025
What Undercode Say:
`npm list next`
`npx next –version`
`npm update next@latest`
`curl -s https://example.com/flight-payload | jq .`
How Exploit:
Malicious Flight Payload:
{
"type": "div",
"props": {
"dangerousProp": {
"toString": "() => { require('child_process').exec('calc'); }"
}
}
}
Protection from this CVE:
Upgrade to patched versions: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7.
Implement strict input validation.
Use network-level WAF rules.
Impact:
Full server compromise.
Data theft, integrity loss.
Arbitrary command execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
