Finding Bugs in Next.js and React Apps (Bug Bounty Guide)
Next.js apps blur client and server. That creates new bug classes: server actions that trust the browser, middleware that only hides UI, and React Server Components that still fetch with over-privileged tokens.
If the target’s HTML contains /_next/ or RSC flight data, use this playbook.
Map the boundary
- Which routes are Server Components vs client?
- Where do server actions / route handlers live (
app/api,actions,route.ts)? - What does middleware actually enforce (cookie present vs role check)?
- Are secrets in
NEXT_PUBLIC_*env vars?
Browse while watching network calls and the RSC payload stream.
High-yield tests
Auth gaps: hit /admin API routes with a normal session; middleware may only protect page navigations.
Server actions: replay action requests, change IDs in the body, remove CSRF/origin headers if present, and try calling actions you were not shown in the UI.
Mass assignment: JSON bodies posted to server actions often bind objects — try extra fields (role, plan).
SSRF / fetch: server components that take URLs from the client.
Cache confusion: CDN caching of personalized RSC responses (authorization data leaking between users).
Client-side still matters
XSS, prototype pollution, and open redirects remain. CSP and React’s escaping help but dangerous dangerouslySetInnerHTML and URL sinks persist.
Report tips
Specify whether the flaw is in middleware, a route handler, or a server action. Include Next.js version if visible and the exact request that bypassed UI protections.
Defensive checklist
- Authorize inside every server action and route handler — not only in middleware or UI.
- Treat server action inputs like public API inputs.
- Keep secrets off
NEXT_PUBLIC_. - Use stable security frameworks for session/CSRF.
- Add tests that call privileged actions as a low-privilege user.
Modern React apps fail where the trust boundary is fuzzy. Find that boundary — then call the server like an attacker.
Original Bugflare guide informed by Next.js authentication guidance and common App Router failure modes.