Executive brief
Next.js is a popular React framework used to build web applications. A vulnerability allows attackers to craft malicious HTTP requests that expose the compiled source code of Server Actions (backend functions), potentially revealing business logic and implementation details. While secrets hardcoded in source code could be exposed, the vulnerability primarily risks disclosure of proprietary logic and algorithms.
Technical details
The vulnerability is a source code disclosure issue affecting Next.js 15.x and 16.x using the App Router, as well as React packages 19.0.0–19.2.1. An unauthenticated, network-based attacker can craft a malicious HTTP request targeting any App Router endpoint to retrieve the compiled source code of Server Functions. The root cause is improper protection of compiled Server Action code. No authentication or special privileges are required to exploit this vulnerability. An attacker gains read-only access to business logic embedded in Server Functions but does not achieve code execution or integrity modification. Patches are available: Next.js 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 16.0.9, and later versions.
Affected products
- Vercel Next.js 15.0.0-canary.0 to 15.5.x, 16.0.0-beta.0 to 16.1.0-canary.16
Timeline
- 2025-12-11: disclosed
- 2025-12-11: advisory: GHSA-w37m-7fhw-fmv9 published; tracked upstream as CVE-2025-55183