New Scanner Released to Detect Exposed ReactJS and Next.js RSC Endpoints (CVE-2025-55182)

Security researchers have released a specialized scanning tool to identify vulnerable React Server Component (RSC) endpoints in modern web applications, addressing a critical gap in the detection of CVE-2025-55182.

New Detection Approach Challenges Existing Security Assumptions

A newly available Python-based scanner is transforming how organizations assess their exposure to CVE-2025-55182 by introducing a sophisticated surface detection methodology.

Unlike traditional exploitation tools that rely on rigid payload injection, this lightweight scanner validates whether servers actively expose the RSC protocol and respond to Next.js action headers.

The CVE-2025-55182 vulnerability affects React 19 and Next.js applications, potentially exposing them to remote code execution attacks through exposed RSC endpoints.

However, security teams have struggled to accurately determine their vulnerability status, as many existing detection methods provide false negatives.

Conventional vulnerability scanning approaches have significant limitations in production environments.

Most aggressive proof-of-concept tools depend on specific payloads, such as vm#runInThisContext, or assume default module identifiers, such as “id”: “vm”. These assumptions prove problematic in real-world deployments.

Production-built applications using Webpack or Turbopack typically minify module identifiers to integers (e.g., 742) or strip them entirely via tree-shaking.

When security teams deploy standard RCE payloads against production builds, the exploits fail silently, creating a dangerous false sense of security.

Surface Detection

According to Fatguru, the new scanner abandons the exploitation-focused approach in favour of surface detection.

Rather than attempting to execute arbitrary code on the target server, the tool systematically verifies whether servers accept RSC protocol requests and process Next.js action headers appropriately.

This methodology detects exposure itself rather than confirming the exploitability of specific code gadgets.

Security researchers emphasize that identifying exposed endpoints is merely the first step.

Organizations that receive positive detection results understand that their servers are accepting RSC payloads and attempting to process them, signaling potential vulnerability.

For security teams confirming exposure through this scanner, actual exploitation validation requires additional investigation.

Rigid payloads fail consistently against production systems due to minified module identifiers.

Instead, organisations must enumerate or fuzz Webpack module IDs, analysing client-side webpack-runtime.js files and chunk assets to extract valid ID mappings for potential gadgets. The scanner offers straightforward command-line functionality.

Users can scan individual targets with python3 cve_2025_55182_scanner.py -u http://localhost:3000/ or process multiple URLs from files for bulk assessment.

The tool requires Python 3 and the standard dependencies available via pip.

Security teams should understand that this tool strictly identifies exposed RSC endpoints and does not execute exploits.

It serves as a detection and awareness mechanism, alerting organizations to check whether their applications accept RSC payloads that require processing.

As CVE-2025-55182 continues to receive attention within the security community, this scanner is an essential contribution to vulnerability discovery workflows, enabling teams to identify at-risk React and Next.js applications before attackers do.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.