Nextjs Attack Probe

Next.js Attack Probe

Authorized probe of a Next.js 13+ App Router app the user owns. Follow shared probing conventions — discover base URL from package.json scripts.dev (default next dev port 3000), next.config.{js,ts} serverRuntimeConfig, Dockerfile EXPOSE, or env (PORT). Never hardcode.

Next.js-specific attack surface

• NEXT_PUBLIC_* env vars are baked into the client JS bundle. Any secret with that prefix is leaked to anyone who fetches the site.
• Server Actions are reachable via crafted POSTs to any page, with Next-Action: <hash> header — no inherent auth.
• /_next/data/<buildId>/...json (Pages Router) and route handlers are often forgotten in middleware matchers.
• next/image proxy can be coerced into SSRF if images.remotePatterns is too permissive.
• ISR revalidatePath/revalidateTag with user-influenced paths → cache poisoning.
• x-middleware-subrequest header bypass (CVE-2025-29927 class) — Next.js < 15.1 patches.

Procedure

1. Authorization preflight + base URL discovery.
2. Pull build manifest: GET /_next/static/chunks/*.js (sample 1-2 main bundles); grep for NEXT_PUBLIC_ and obvious secret shapes.
3. Probe per rule table.

Rules

Special handling

• NEXT-ENV-001 is the most common high-impact finding. When confirmed, list each leaked variable name (not value, unless explicitly requested) and the file path inside the bundle.
• NEXT-MW-001 must be reported even if the patch is applied — the user may run multiple Next versions in monorepo.

Wrong vs. right

NEXT-ENV-001 (env leak)

// ❌ This ships to every browser
// .env
NEXT_PUBLIC_OPENAI_API_KEY=sk-live-...

// any component
const key = process.env.NEXT_PUBLIC_OPENAI_API_KEY;

// ✅ Server-only env, called from a route handler
// .env
OPENAI_API_KEY=sk-live-...

// app/api/chat/route.ts
export async function POST(req: Request) {
  const key = process.env.OPENAI_API_KEY;  // never sent to client
  // ...
}

NEXT-SA-001 (unauth server action)

// ❌
"use server";
export async function deleteAccount(id: string) {
  await db.user.delete({ where: { id } });
}

// ✅
"use server";
import { auth } from "@/auth";
import { z } from "zod";

const Schema = z.object({ id: z.string().uuid() });

export async function deleteAccount(input: unknown) {
  const session = await auth();
  if (!session?.user) throw new Error("Unauthorized");
  const { id } = Schema.parse(input);
  if (session.user.id !== id && session.user.role !== "admin") {
    throw new Error("Forbidden");
  }
  await db.user.delete({ where: { id } });
}

References

• Next.js Server Actions: https://nextjs.org/docs/app/api-reference/functions/server-actions
• Next.js Middleware: https://nextjs.org/docs/app/building-your-application/routing/middleware
• CVE-2025-29927: https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
• Next.js Image Optimization: https://nextjs.org/docs/app/api-reference/components/image#remotepatterns