Next.js Known CVE Scanner

Overview

Different Next.js advisories demand different evidence. A version match can prioritize a host, but no safe remote confirm exists for every flaw. This workflow takes a file of web servers, fingerprints Next.js with httpx, and returns a separate, evidence-qualified finding for each of four advisories, including React2Shell (CVE-2025-55182). CVE-2026-75604 walks ..%5C toward a canary and compares a control. GHSA-2xp9-vwfh-vxw4 probes /_next/image with a local asset, a remote URL, an .avif name, and two JPEG widths. A fetch is not marked as remote code execution. CVE-2025-29927 and CVE-2025-55182 are version-only: the run never sends the middleware bypass header and never sends a Flight body. Each node writes its own findings. The last node merges them into report.json, one final_report.jsonl line per advisory, findings.jsonl, and owner.csv. Most other Next.js advisories have no safe remote check and stay off the graph. Attach the host file and check these hosts from exposure management.

Pipeline

1. Read the host file (hosts, URLs, or JSONL) and write one URL per line for httpx.
2. httpx live-checks each host and records title, tech, web server, and status.
3. fingerprint maps Next.js: printed version, Windows server signal, buildId, Pages via /_next/data, App via RSC headers, and the cache paths CVE-2026-75604 will walk.
4. cve-2026-75604 walks ..%5C toward a canary and compares a control. It does not read server-reference-manifest.json and does not forge a Server Action.
5. ghsa-2xp9-vwfh-vxw4 classifies /_next/image. It never sends crafted AVIF bytes and never marks a fetch as RCE.
6. cve-2025-29927 is version-only. It never sends a middleware bypass header.
7. cve-2025-55182 is version-only. It never sends a Flight body.
8. report merges the four streams into findings.jsonl, report.json, one final_report.jsonl line per advisory, and owner.csv. Unknown version is never clean on a version-gated CVE.

Inputs

• Host file. A file of web servers, one per line: hostname, host:port, http(s) URL, or JSONL with url / host. Point it at Next.js apps you are authorised to test. Blanks and # comments are skipped. The node keeps the first 200 hosts. If no file is attached, the default is example.com.

Outputs

• findings.jsonl. One operator row per host per advisory: cve, advisory, target_url, is_nextjs, observed version, vulnerable, confirmed, action, check_detail, and evidence.
• report.json. Title, the four advisory IDs, generated timestamp, overall summary, by_advisory counts, and the full findings list.
• final_report.jsonl. One manager line per advisory (total_targets, vulnerable, not_vulnerable, inconclusive, errors, vulnerability_rate, patch).
• owner.csv. The same rows flattened for the people who own the hosts.

Integrations

• httpx for the initial live-host and Next.js fingerprint pass.
• HTTP for the advisory-specific canary, image optimizer, and version checks.

Sample output

Illustrative, in the record shape the workflow emits. Real runs name live hosts, so the targets here are documentation domains.

The final report is one line per advisory:

{"cve": "CVE-2026-75604", "total_targets": 2, "findings": 2, "vulnerable": 1, "not_vulnerable": 1, "inconclusive": 0, "errors": 0, "vulnerability_rate": 50.0, "patch": "15.5.24 (15.x) or 16.3.3 (16.x)"}
{"cve": "GHSA-2xp9-vwfh-vxw4", "total_targets": 2, "findings": 2, "vulnerable": 0, "not_vulnerable": 1, "inconclusive": 1, "errors": 0, "vulnerability_rate": 0.0, "patch": "15.5.24 (15.x) or 16.3.3 (16.x)"}
{"cve": "CVE-2025-29927", "total_targets": 2, "findings": 2, "vulnerable": 0, "not_vulnerable": 1, "inconclusive": 1, "errors": 0, "vulnerability_rate": 0.0, "patch": "12.3.5 / 13.5.9 / 14.2.25 / 15.2.3"}
{"cve": "CVE-2025-55182", "total_targets": 2, "findings": 2, "vulnerable": 0, "not_vulnerable": 1, "inconclusive": 1, "errors": 0, "vulnerability_rate": 0.0, "patch": "15.0.5+ / 16.0.7"}

report.json wraps those findings with title, cve (the four IDs), generated, summary, by_advisory, and the full findings array.

FAQ

Which Next.js builds does this flag as in range?

CVE-2026-75604: 13.4 through the last 15.x before 15.5.24, and 16.0 through the last 16.x before 16.3.3. GHSA-2xp9-vwfh-vxw4 starts earlier, at 10.0.0, and uses the same patched builds. CVE-2025-29927 and CVE-2025-55182 use their own floors and stay version-only. Each finding is scored on its own advisory. A printed version in range is not enough on its own, and a blank version is never written as clean. A canary or rc tag is also never written as clean.

When does CVE-2026-75604 not apply even if the version is in range?

The Windows cache bug needs a Windows filesystem and both the Pages router (/_next/data) and the App router answering on the same host. Linux and macOS hosts are not this CVE. Missing an IIS banner is not proof of Linux: that row is go look. The check still sends the %5C pair so you can see whether the separator was evaluated. The AVIF finding on the same host is independent: an open optimizer does not mark the Windows row vulnerable.

What does go look mean when the host prints no version?

Next.js was fingerprinted and the version string was blank. That advisory's row is not clean. If the Windows check already confirmed a traversal on Windows with Pages and App, that row is patch. A remote or .avif fetch on the GHSA node is go look, not patch: a fetch is not remote code execution. Otherwise action is go look: fetch the lockfile or the deployed image tag before you close the ticket.

Does GHSA-2xp9-vwfh-vxw4 send a crafted AVIF?

No. It asks /_next/image for a local asset, a remote HTTPS URL, a URL that ends in .avif, and two widths of a public JPEG. A fetch or a resize is recorded on optimizer. A crafted overflow AVIF is never sent, so a 200 here is not remote code execution and the row is never marked vulnerable.

How is this different from the public CVE-2026-75604 PoC?

The public PoC walks ..%5C out of a Pages ISR and App cache path, reads the Server Action manifest, forges an action, and runs a command. This workflow keeps only the first step's shape: the same walk, aimed at a canary filename, compared to a control. A diverge is the confirm. The run does not read the manifest, does not take a key, and does not send a Server Action.

Related workflows

• WordPress Pre-Auth RCE (CVE-2026-63030). Reach for this instead when the product is WordPress and you need a confirmed injection chain, not a Next.js cache or image check.
• SPA Endpoint and Parameter Map. Reach for this instead when you want the JS bundle's routes and parameters, not a yes or no on these two Next.js paths.
• Exposed Database Scanner. Reach for this instead when the question is an open data store on the same fleet, not the Next.js security scanner.