GHSA-w37m-7fhw-fmv9

What it actually does

The flaw can allow remote exposure of Next.js Server Actions source code through improper handling of serialized Server Actions or React Server Components request data. At a technical level, an attacker may be able to cause the application to disclose server-side implementation details, including action logic, imports, comments, internal paths, or embedded constants that were not intended to be sent to the browser. The issue is primarily an information disclosure vulnerability; it does not by itself imply code execution, but exposed source can materially aid follow-on attacks such as credential discovery, business-logic abuse, endpoint mapping, or targeted exploitation of other defects.

Why it matters to the business

Organizations running affected versions of the next npm package may unintentionally expose proprietary application logic and sensitive implementation details to unauthenticated or low-privileged users. The operational impact can include leakage of intellectual property, discovery of hidden functionality, exposure of secrets accidentally embedded in source, and faster attacker reconnaissance against public-facing applications. The vulnerability has a moderate CVSS score and is not listed in CISA KEV, and no mature public exploitation is indicated in the provided data; however, it has been public for 241 days, so internet-facing applications should be reviewed and upgraded rather than treated as a theoretical issue.

How an attack unfolds

An attacker first identifies an application built with a vulnerable Next.js version that uses Server Actions or React Server Components. They then send crafted HTTP requests that resemble legitimate Server Actions traffic, often involving POST requests, React Server Component negotiation headers, action identifiers, serialized payloads, or malformed action data. Because the vulnerable server mishandles the serialized action request, it may return source code or bundled server-side module content instead of only the intended action result. The attacker reviews the disclosed code for hardcoded credentials, internal API routes, authorization checks, business rules, package versions, file paths, and other clues. Even if no secrets are directly exposed, the leaked code can reduce the effort needed for subsequent attacks against authentication, authorization, SSRF, injection, or supply-chain weaknesses.

How to fix it

Upgrade the next npm package to a fixed release for the branch in use. Fixed versions provided are: 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, or 16.1.0-canary.17. Prefer a stable fixed release over a canary release unless the application already tracks canary builds. After upgrading, rebuild and redeploy the application so server bundles and route handlers are regenerated. Also remove any secrets, tokens, private keys, internal credentials, or sensitive configuration values that may have been embedded in source code; rotate them if exposure is possible. As defense in depth, restrict unnecessary public access to sensitive routes, avoid placing secrets directly in application source, review Server Actions for strict authorization checks, and ensure edge/CDN caches do not store erroneous source-code responses.

How to confirm the fix worked

Confirm the deployed package version using package manifests and lockfiles, for example by checking package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, or running dependency inspection commands such as npm ls next in the build context. Verify that the deployed application is running one of the fixed next versions, not only that the repository has been updated. Rebuild the application from a clean dependency install and confirm the deployment artifact contains the updated Next.js version. Perform controlled testing against Server Actions and React Server Components endpoints to ensure malformed or unexpected action requests return normal errors or sanitized responses rather than source code, module text, stack traces, or source maps. Review CDN and application caches for previously cached responses containing source fragments such as use server, webpack-internal paths, imports, or sourceMappingURL comments.

Typical attack path

1. Fingerprint the target application as Next.js by inspecting response headers, HTML assets, build output paths, or JavaScript bundle naming patterns.
2. Determine whether the application uses Server Actions or React Server Components by observing traffic patterns such as RSC requests, action posts, or Next.js-specific request headers.
3. Send crafted Server Actions requests with action identifiers, serialized payloads, malformed parameters, or React Server Component headers to trigger the vulnerable code path.
4. Inspect HTTP responses for server-side source code, module paths, stack traces, source maps, imports, comments, or implementation details not normally exposed to clients.
5. Extract useful information such as secrets, internal routes, authorization logic, dependency versions, or business rules.
6. Use the disclosed information to plan follow-on attacks, including credential abuse, endpoint targeting, authorization bypass attempts, or exploitation of separate vulnerabilities.

How to detect it

Investigate whether this was already exploited by reviewing HTTP access logs, application logs, reverse proxy logs, CDN logs, WAF events, and any request/response capture available for Next.js applications. Focus on POST requests and React Server Components traffic containing Next.js Server Actions indicators such as Next-Action headers, RSC headers, multipart form submissions, text/x-component responses, or _rsc query parameters. Look for repeated probing, malformed serialized payloads, unusual 4xx/5xx clusters, unexpectedly large responses from action-related routes, and responses containing source-code artifacts such as 'use server', import statements, webpack-internal paths, sourceMappingURL comments, absolute application paths, or JavaScript/TypeScript module text. If response bodies are logged or retained by a CDN/WAF, search for server-side code fragments in responses to untrusted clients. Also review CDN caches and object stores for accidentally cached source-code responses. Because normal Next.js Server Actions traffic may include some of these request markers, treat them as triage indicators and correlate with response size, status code, user agent diversity, request repetition, unauthenticated access, and source-code content in the response.

• Next-Action:
• RSC: 1
• text/x-component
• _rsc=
• multipart/form-data
• 'use server'
• "use server"
• webpack-internal://
• //# sourceMappingURL=
• __webpack_require__
• app-page.runtime
• server-reference-manifest
• server-actions-manifest
• next-action

What your security team should do

• Prioritize internet-facing Next.js applications that use Server Actions or React Server Components, especially those running next versions below the listed fixed releases.
• Upgrade next to the appropriate fixed version for the active branch, rebuild from a clean install, and redeploy all affected applications.
• Search application, CDN, WAF, reverse proxy, and access logs for unusual Server Actions traffic, repeated malformed POST requests, and responses with unusually large sizes or source-code-like content.
• Review exposed code risk by checking whether sensitive values, private endpoints, authorization logic, or internal service details were embedded in server-side source.
• Rotate any credentials, API keys, tokens, or signing secrets that may have been present in source code or configuration reachable from disclosed code paths.
• Add or tune detections for abnormal Next.js Server Actions requests, especially requests containing Next-Action, RSC negotiation headers, malformed multipart bodies, or repeated probing of action endpoints.
• Ensure secrets are stored in runtime secret management mechanisms and not in committed source, comments, build-time constants, or client-visible environment variables.
• If suspicious access is found, preserve relevant HTTP logs, response samples, CDN cache records, and deployment artifacts for incident investigation.