A file of web servers: hostname, host:port, URL, or JSONL. Point it at Next.js apps you are authorised to test.
How It Works
httpx live-checks the file. fingerprint maps Next.js. Four advisory nodes run in parallel. Detection only. No exploit payload is sent.
Results
report.json, findings.jsonl, one final_report.jsonl line per advisory, and owner.csv. Unknown version is never clean.
Overview
This is a Next.js security scanner with one canvas node per advisory. It
takes a file of web servers, fingerprints Next.js with httpx,
then fans out to four checks. CVE-2026-75604 walks ..%5C toward a canary and
compares a control. GHSA-2xp9-vwfh-vxw4 probes /_next/image with a local
asset, a remote URL, an .avif name, and two JPEG widths. A fetch is not
marked as remote code execution. CVE-2025-29927 and CVE-2025-55182 are
version-only: the run never sends the middleware bypass header and never
sends a Flight body. Each node writes its own findings. The last node merges
them into report.json, one final_report.jsonl line per advisory,
findings.jsonl, and owner.csv. Most other Next.js advisories have no safe
remote check and stay off the graph. Attach the host file and check these
hosts from exposure management.
Pipeline
Read the host file (hosts, URLs, or JSONL) and write one URL per line for httpx.
httpx live-checks each host and records title, tech, web
server, and status.
fingerprint maps Next.js: printed version, Windows server signal, buildId,
Pages via /_next/data, App via RSC headers, and the cache paths
CVE-2026-75604 will walk.
cve-2026-75604 walks ..%5C toward a canary and compares a control. It
does not read server-reference-manifest.json and does not forge a Server
Action.
ghsa-2xp9-vwfh-vxw4 classifies /_next/image. It never sends crafted AVIF
bytes and never marks a fetch as RCE.
cve-2025-29927 is version-only. It never sends a middleware bypass header.
cve-2025-55182 is version-only. It never sends a Flight body.
report merges the four streams into findings.jsonl, report.json, one
final_report.jsonl line per advisory, and owner.csv. Unknown version is
never clean on a version-gated CVE.
Inputs
Host file. A file of web servers, one per line: hostname, host:port,
http(s) URL, or JSONL with url / host. Point it at Next.js apps you
are authorised to test. Blanks and # comments are skipped. The node keeps
the first 200 hosts. If no file is attached, the default is example.com.
Outputs
findings.jsonl. One operator row per host per advisory: cve, advisory,
target_url, is_nextjs, observed version, vulnerable, confirmed,
action, check_detail, and evidence.
report.json. Title, the four advisory IDs, generated timestamp, overall summary,
by_advisory counts, and the full findings list.
final_report.jsonl. One manager line per advisory (total_targets,
vulnerable, not_vulnerable, inconclusive, errors,
vulnerability_rate, patch).
owner.csv. The same rows flattened for the people who own the hosts.
Sample output
Illustrative, in the record shape the workflow emits. Real runs name live hosts,
so the targets here are documentation domains.
cve
advisory
target_url
is_nextjs
observed_version
vulnerable
confirmed
error
action
check_detail
evidence
windows_signal
pages_and_app
optimizer
CVE-2026-75604
GHSA-p293-qw3h-jr36
https://app.example.com
true
16.2.6
true
true
null
patch to 15.5.24 or 16.3.3
traversal=diverged; pages_and_app=true
traversal diverged on Windows with Pages and App
IIS
true
present
GHSA-2xp9-vwfh-vxw4
GHSA-2xp9-vwfh-vxw4
https://app.example.com
true
16.2.6
false
false
null
go look
optimizer fetches_remote; a fetch is not RCE for this GHSA
optimizer fetches_remote; a fetch is not RCE for this GHSA
report.json wraps those findings with title, cve (the four IDs), generated,
summary, by_advisory, and the full findings array.
FAQ
Which Next.js builds does this flag as in range?
CVE-2026-75604: 13.4 through the last 15.x before 15.5.24, and 16.0 through the
last 16.x before 16.3.3. GHSA-2xp9-vwfh-vxw4 starts earlier, at 10.0.0, and uses
the same patched builds. CVE-2025-29927 and CVE-2025-55182 use their own floors
and stay version-only. Each finding is scored on its own advisory. A printed
version in range is not enough on its own, and a blank version is never written
as clean. A canary or rc tag is also never written as clean.
When does CVE-2026-75604 not apply even if the version is in range?
The Windows cache bug needs a Windows filesystem and both the Pages router
(/_next/data) and the App router answering on the same host. Linux and macOS
hosts are not this CVE. Missing an IIS banner is not proof of Linux: that row
is go look. The check still sends the %5C pair so you can see whether the
separator was evaluated. The AVIF finding on the same host is independent: an
open optimizer does not mark the Windows row vulnerable.
What does go look mean when the host prints no version?
Next.js was fingerprinted and the version string was blank. That advisory's
row is not clean. If the Windows check already confirmed a traversal on
Windows with Pages and App, that row is patch. A remote or .avif fetch on
the GHSA node is go look, not patch: a fetch is not remote code execution.
Otherwise action is go look: fetch the lockfile or the deployed image tag
before you close the ticket.
Does GHSA-2xp9-vwfh-vxw4 send a crafted AVIF?
No. It asks /_next/image for a local asset, a remote HTTPS URL, a URL that
ends in .avif, and two widths of a public JPEG. A fetch or a resize is
recorded on optimizer. A crafted overflow AVIF is never sent, so a 200 here
is not remote code execution and the row is never marked vulnerable.
How is this different from the public CVE-2026-75604 PoC?
The public PoC walks ..%5C out of a Pages ISR and App cache path, reads the
Server Action manifest, forges an action, and runs a command. This workflow
keeps only the first step's shape: the same walk, aimed at a canary filename,
compared to a control. A diverge is the confirm. The run does not read the
manifest, does not take a key, and does not send a Server Action.
Related workflows
WordPress Pre-Auth RCE (CVE-2026-63030).
Reach for this instead when the product is WordPress and you need a confirmed
injection chain, not a Next.js cache or image check.
SPA Endpoint and Parameter Map.
Reach for this instead when you want the JS bundle's routes and parameters,
not a yes or no on these two Next.js paths.
Exposed Database Scanner. Reach for this
instead when the question is an open data store on the same fleet, not the
Next.js security scanner.