nextjs-Stack-Frame-Extractor

eaks original TypeScript/JavaScript source files from Next.js applications that expose the /__nextjs_original-stack-frame debug endpoint on the network.

How it works

Next.js dev servers expose /__nextjs_original-stack-frame to power the error overlay. The endpoint accepts a webpack-internal:// file URL and a compiled line/column number, then uses the bundle's source maps to return the original source context.

This tool walks compiled line numbers, uses a bracket-depth-aware column predictor to avoid brute-forcing every column, and stitches the overlapping codeFrame windows back into the complete original file — without needing the source map files directly.

Webpack bundles emit source map entries at code-significant positions (function starts, declarations). The predictor tracks bracket depth from the decoded source to predict which compiled column offset to try next, reducing the average cost to 1–3 requests per source map entry.

Requirements

pip install requests

Usage

usage: nextjs_stackframe_extractor.py host file [options]

positional arguments:
  host          Target base URL  (e.g. http://10.1.1.80)
  file          Source file path (e.g. src/components/datasets/bulk-upload.tsx)

scan options:
  --line  -l N  Seed compiled line from a captured request (default: 10)
  --column -c N Seed compiled column (default: 1)

runtime flags:
  --server      File is server-side — tries (rsc) prefix first
  --edge        File is edge runtime — tries (edge-server) prefix first

output:
  --output -o FILE  Write extracted source to FILE (default: stdout)
  --verbose -v      Show per-request detail: column chosen, bracket depth, predictor state

misc:
  --timeout SEC     HTTP request timeout in seconds (default: 10)
  --no-verify       Disable TLS certificate verification

Examples

# Browser-side component
python3 nextjs_stackframe_extractor.py http://10.1.1.80 src/components/upload.tsx

# Server-side file (RSC / API route)
python3 nextjs_stackframe_extractor.py http://10.1.1.80 src/lib/auth.ts --server

# App Router API route, save to disk, show column decisions
python3 nextjs_stackframe_extractor.py http://10.1.1.80 \
  src/app/api/admin/run-pipeline/route.ts \
  --server --output route.ts --verbose

# HTTPS with self-signed cert
python3 nextjs_stackframe_extractor.py https://target.internal \
  src/lib/db.ts --server --no-verify

Seeding

The --line and --column values come from any request you observe hitting the endpoint (e.g. from Burp). If you have no captured request, the defaults (--line 10 --column 1) work for most files. The tool auto-tries all four webpack prefixes ((rsc), (app-pages-browser), (pages), (edge-server)) and runs a seed-line sweep if the initial probe misses.

Affected versions

Any Next.js application running in development mode (next dev) with the debug server network-accessible. This is not a vulnerability in Next.js itself — the endpoint is intentional for local development. The risk arises when dev servers are deployed or exposed without access controls.

Detection

Probe for the endpoint:

GET /__nextjs_original-stack-frame HTTP/1.1

A 204 No Content or 200 response confirms the endpoint is active. A 404 means the application is running in production mode or the route is blocked.

Legal

For use on systems you own or have explicit written permission to test. Unauthorised access to computer systems is illegal.