5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-w37m-7fhw-fmv9

GHSA-w37m-7fhw-fmv9: Next Server Actions Source Code Exposure

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183.

A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-w37m-7fhw-fmv9

GHSA-w37m-7fhw-fmv9:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
next	npm	>= 15.0.0-canary.0, < 15.0.6	15.0.6
next	npm	>= 15.1.1-canary.0, < 15.1.10	15.1.10
next

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-w37m-7fhw-fmv9, allows for the exposure of Server Actions source code in Next.js. The root cause lies in the insufficient validation of incoming HTTP requests for server actions, particularly those that are URL-encoded. The primary function responsible for this is handleAction in packages/next/src/server/app-render/action-handler.ts.

In vulnerable versions, this function would attempt to process URL-encoded action requests. An attacker could craft a malicious request that, upon being processed, would cause an error during the action decoding phase. The resulting error handling could then improperly expose the compiled source code of the server function.

The patch addresses this by introducing several key changes:

Rejection of URL-encoded Actions: The code now explicitly checks for and rejects application/x-www-form-urlencoded content types for server actions, which was a primary vector for the attack.
Pre-validation of Action IDs: New functions, such as areAllActionIdsValid, isInvalidStringActionDescriptor, and isInvalidActionIdFieldName, have been added. These functions perform checks on the action IDs and their descriptors within the request payload before the main decoding logic is invoked. This ensures that only requests referencing valid and well-formed server actions are processed, preventing the decoding of malicious payloads.
Early Exit for Apps without Server Actions: A check (hasServerActions) was added to quickly return a 'not-found' response if an application does not have any server actions defined, reducing the attack surface.

By analyzing the patch, it's clear that the handleAction function is the main entry point for the vulnerability. During exploitation, this function would be present in any runtime profile or stack trace. The addition of the validation functions highlights the lack of input sanitization that was the core of the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.