https://poc.intelseclab.com/tags/nextjs/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-55182-react-server-components-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-55182-react-server-components-rce/Critical severity (CVSS 10) — web · CVE-2025-55182. Status: PoC. Affects: React Server Components (RSC) packages using the Flight protocol (commonly deployed via Next.js). Tags: react, react-server-components, rsc, flight-protocol, prototype-pollution, deserialization, unauthenticated-rce, nextjs, nodejs, python.webCriticalreactreact-server-componentsrscflight-protocolprototype-pollutiondeserializationunauthenticated-rcenextjsnodejspythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33671-nextjs-vendored-picomatch-dep/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33671-nextjs-vendored-picomatch-dep/High severity — web · CVE-2026-33671. Status: PoC. Affects: Next.js 16.2.4 (bundles picomatch 4.0.3 at node_modules/next/dist/compiled/picomatch/). Tags: nextjs, picomatch, vendored-dependency, supply-chain, sca-bypass, trivy, nodejs, dependency-scanning.webHighnextjspicomatchvendored-dependencysupply-chainsca-bypasstrivynodejsdependency-scanninghttps://poc.intelseclab.com/pocs/web/2026-07-03_nextjs-unstable-cache-key-collision/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-03_nextjs-unstable-cache-key-collision/High severity — web · None assigned as of 2026-07-03. Status: PoC. Affects: Next.js (App Router, Data Cache). Tags: nextjs, unstable_cache, cache-poisoning, cache-key-collision, data-cache, information-disclosure, server-side-caching, javascript.webHighnextjsunstable_cachecache-poisoningcache-key-collisiondata-cacheinformation-disclosureserver-side-cachingjavascript