CVE-2025-55183
published 2025-12-11CVE-2025-55183: An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and…
PriorityP261medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
62.41%
99.1th percentile
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| react | >= 19.0.0 < 19.0.2 | 19.0.2 | |
| react | >= 19.1.0 < 19.1.3 | 19.1.3 | |
| react | >= 19.2.0 < 19.2.2 | 19.2.2 | |
| meta | react-server-dom-parcel | >= 19.0.0 < 19.0.2 | 19.0.2 |
| meta | react-server-dom-parcel | 19.0.0 – 19.0.1 | — |
| meta | react-server-dom-parcel | >= 19.1.0 < 19.1.3 | 19.1.3 |
| meta | react-server-dom-parcel | 19.1.0 – 19.1.2 | — |
| meta | react-server-dom-parcel | >= 19.2.0 < 19.2.2 | 19.2.2 |
| meta | react-server-dom-parcel | 19.2.0 – 19.2.1 | — |
| meta | react-server-dom-turbopack | >= 19.0.0 < 19.0.2 | 19.0.2 |
| meta | react-server-dom-turbopack | 19.0.0 – 19.0.1 | — |
| meta | react-server-dom-turbopack | >= 19.1.0 < 19.1.3 | 19.1.3 |
| meta | react-server-dom-turbopack | 19.1.0 – 19.1.2 | — |
| meta | react-server-dom-turbopack | >= 19.2.0 < 19.2.2 | 19.2.2 |
| meta | react-server-dom-turbopack | 19.2.0 – 19.2.1 | — |
| meta | react-server-dom-webpack | >= 19.0.0 < 19.0.2 | 19.0.2 |
| meta | react-server-dom-webpack | 19.0.0 – 19.0.1 | — |
| meta | react-server-dom-webpack | >= 19.1.0 < 19.1.3 | 19.1.3 |
| meta | react-server-dom-webpack | 19.1.0 – 19.1.2 | — |
| meta | react-server-dom-webpack | >= 19.2.0 < 19.2.2 | 19.2.2 |
| meta | react-server-dom-webpack | 19.2.0 – 19.2.1 | — |
| next | next | >= 15.0.0-canary.0 < 15.0.6 | 15.0.6 |
| next | next | >= 15.1.1-canary.0 < 15.1.10 | 15.1.10 |
| next | next | >= 15.2.0-canary.0 < 15.2.7 | 15.2.7 |
| next | next | >= 15.3.0-canary.0 < 15.3.7 | 15.3.7 |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2025-55183 is triggered by a specifically crafted HTTP request to a Server Function endpoint that causes the server to unsafely return source code of any Server Function; look for anomalous HTTP responses containing server-side source code from Server Function endpoints. ↗
- →Exploitation requires a Server Function that explicitly or implicitly exposes a stringified argument; audit all Server Function implementations for string coercion of arguments as a prerequisite indicator of exploitability. ↗
- →CVE-2025-55183 affects react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack, and @vitejs/plugin-rsc; inventory these packages and flag any deployment running versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, or 19.2.1. ↗
- →CVE-2025-55183 is an information disclosure (source code leak) with limited impact; it is distinct from the critical RCE CVE-2025-55182 but shares the same React Server Components attack surface — Server Function HTTP endpoints. ↗
- ·CVE-2025-55183 only manifests in 'specific configurations' where a Server Function explicitly or implicitly exposes a stringified argument; not all deployments of the affected package versions are exploitable. ↗
- ·Patching to at least React Server Components 19.2.2 is required to remediate CVE-2025-55183's information disclosure; 19.2.2 also addresses CVE-2025-55184 DoS but NOT CVE-2025-67779 DoS — 19.2.3 is needed for full DoS coverage. ↗
- ·For @vitejs/plugin-rsc, the fix for CVE-2025-55183 is version 0.5.7. ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
ghsa5.3MEDIUM
osv5.3MEDIUM
vendor_redhat5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Source Code Exposure Vulnerability in React Server Components
osv·2025-12-11
CVE-2025-55183 [MEDIUM] Source Code Exposure Vulnerability in React Server Components
Source Code Exposure Vulnerability in React Server Components
## Impact
There is a source code exposure vulnerability in React Server Components.
React recommends updating immediately.
The vulnerability exists in versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of:
- [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
- [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
- [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)
These issues are present in the patches published last week.
## Patches
Fixes were back ported to versions 19.0.2, 19.1.3, and 19.2.2.
If you are using any of the above packages please upgrade to any of the fixed versions immediately.
GHSA
Next Server Actions Source Code Exposure
ghsa·2025-12-11·CVSS 5.3
CVE-2025-55183 [MEDIUM] CWE-1395 Next Server Actions Source Code Exposure
Next Server Actions Source Code Exposure
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183).
A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of [Server Functions](https://react.dev/reference/rsc/server-functions). This could reveal business logic, but would not expose secrets unless they were hardcoded directly into [Server Function](https://react.dev/reference/rsc/server-functions) code.
OSV
Next Server Actions Source Code Exposure
osv·2025-12-11·CVSS 5.3
CVE-2025-55183 [MEDIUM] Next Server Actions Source Code Exposure
Next Server Actions Source Code Exposure
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183).
A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of [Server Functions](https://react.dev/reference/rsc/server-functions). This could reveal business logic, but would not expose secrets unless they were hardcoded directly into [Server Function](https://react.dev/reference/rsc/server-functions) code.
GHSA
Source Code Exposure Vulnerability in React Server Components
ghsa·2025-12-11
CVE-2025-55183 [MEDIUM] CWE-497 Source Code Exposure Vulnerability in React Server Components
Source Code Exposure Vulnerability in React Server Components
## Impact
There is a source code exposure vulnerability in React Server Components.
React recommends updating immediately.
The vulnerability exists in versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of:
- [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
- [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
- [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)
These issues are present in the patches published last week.
## Patches
Fixes were back ported to versions 19.0.2, 19.1.3, and 19.2.2.
If you are using any of the above packages please upgrade to any of the fixed versions immediately.
Red Hat
next: React Server Components: Source code exposure through crafted HTTP request
vendor_redhat·2025-12-11·CVSS 5.3
CVE-2025-55183 [MEDIUM] CWE-497 next: React Server Components: Source code exposure through crafted HTTP request
next: React Server Components: Source code exposure through crafted HTTP request
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
A flaw was found in React Server Components (RSC). This vulnerability allows an information leak, where a specifically crafted HTTP (Hypertext Transfer Protocol) request to a vulnerable
No detection rules found.
Nuclei
React Server Components - Denial of Service
nuclei·CVSS 7.5
CVE-2025-55184 [HIGH] React Server Components - Denial of Service
React Server Components - Denial of Service
React Server Components 19.0.0 to 19.2.1 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain an insecure deserialization vulnerability caused by unsafe payload deserialization in Server Function endpoints, letting unauthenticated attackers cause denial of service by hanging the server process.
Template:
id: CVE-2025-55184
info:
name: React Server Components - Denial of Service
author: DhiyaneshDk
severity: high
description: |
React Server Components 19.0.0 to 19.2.1 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain an insecure deserialization vulnerability caused by unsafe payload deserialization in Server Function endpoints, letting unauthentica
Mandiant
Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)
blogs_mandiant·2025-12-12·CVSS 10.0
CVE-2025-55182 [CRITICAL] Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)
## Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)
## Google Threat Intelligence Group
## Google Threat Intelligence
Visibility and context on the threats that matter most.
Written by: Aragorn Tseng, Robert Weiner, Casey Charrier, Zander Work, Genevieve Stark, Austin Larsen
## Introduction
On Dec. 3, 2025, a critical unauthenticated remote code execution (RCE) vulnerability in React Server Components, tracked as CVE-2025-55182 (aka "React2Shell"), was publicly disclosed. Shortly after disclosure, Google Threat Intelligence Group (GTIG) had begun observing widespread exploitation across many threat clusters, ranging from opportunistic cyber crime actors to suspected espionage groups.
GTIG has identified distinct campaigns leveraging this vulnerability to deploy a MINOCAT
Mandiant
Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)
blogs_mandiant·2025-12-12·CVSS 10.0
CVE-2025-55182 [CRITICAL] Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)
Threat Intelligence
# Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)
December 12, 2025
##### Google Threat Intelligence Group
##### Google Threat Intelligence
Visibility and context on the threats that matter most.
Contact Us & Get a Demo
Written by: Aragorn Tseng, Robert Weiner, Casey Charrier, Zander Work, Genevieve Stark, Austin Larsen
### Introduction
On Dec. 3, 2025, a critical unauthenticated remote code execution (RCE) vulnerability in React Server Components, tracked as CVE-2025-55182 (aka "React2Shell"), was publicly disclosed. Shortly after disclosure, Google Threat Intelligence Group (GTIG) had begun observing widespread exploitation across many threat clusters, ranging from opportunistic cyber crime actors to suspected espionage groups.
GTIG has identifie
Zscaler
React2Shell RCE Vulnerability (CVE-2025-55182) | ThreatLabz
blogs_zscaler·2025-12-08·CVSS 10.0
[CRITICAL] React2Shell RCE Vulnerability (CVE-2025-55182) | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Wiz
CVE-2025-67779 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 10.0
CVE-2025-67779 [CRITICAL] CVE-2025-67779 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-67779 :
React Server Components vulnerability analysis and mitigation
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Source : NVD
## 7.5
Score
Published December 12, 2025
Severity HIGH
CNA Score 7.5
High-profile Vulnerability Yes
Affected Technologies
React Server Components
Next.js
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Da
Wiz
GHSA-c6m7-q6pr-c64r Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
[MEDIUM] GHSA-c6m7-q6pr-c64r Impact, Exploitability, and Mitigation Steps | Wiz
## GHSA-c6m7-q6pr-c64r :
Vite RSC Plugin vulnerability analysis and mitigation
## Impact
@vitejs/plugin-rsc
react-server-dom-webpack
## Patches
@vitejs/[email protected]
Source : NVD
## 5.3
Score
Published December 12, 2025
Severity MEDIUM
CNA Score N/A
Affected Technologies
Vite RSC Plugin
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
@vitejs/plugin-rsc
Sources
NVD
npm Severity MEDIUM Has Fix Added at: Dec 12, 2025
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Vite RSC Plugin vulnerabilities:
Wiz
GHSA-w37m-7fhw-fmv9 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2025-55183 [MEDIUM] GHSA-w37m-7fhw-fmv9 Impact, Exploitability, and Mitigation Steps | Wiz
## GHSA-w37m-7fhw-fmv9 :
Next.js vulnerability analysis and mitigation
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183 .
A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions . This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.
Source : NVD
## 5.3
Score
Published December 11, 2025
Severity MEDIUM
CNA Score N/A
Affected Technologies
Next.js
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Da
Wiz
CVE-2025-67489 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2025-67489 [MEDIUM] CVE-2025-67489 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-67489 :
Vite RSC Plugin vulnerability analysis and mitigation
@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications that expose server function endpoints. Attackers with network access to the development server can read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using vite --host to expose the server on all network interfaces. This issue is fixed in version 0.5.6.
Sou
Wiz
GHSA-cpqf-f22c-r95x Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
[MEDIUM] GHSA-cpqf-f22c-r95x Impact, Exploitability, and Mitigation Steps | Wiz
## GHSA-cpqf-f22c-r95x :
Vite RSC Plugin vulnerability analysis and mitigation
## Impact
@vitejs/plugin-rsc
react-server-dom-webpack
## Patches
@vitejs/[email protected]
Source : NVD
## 7.5
Score
Published December 12, 2025
Severity HIGH
CNA Score N/A
Affected Technologies
Vite RSC Plugin
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
@vitejs/plugin-rsc
Sources
NVD
npm Severity HIGH Has Fix Added at: Dec 12, 2025
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Vite RSC Plugin vulnerabilities:
CV
Wiz
CVE-2025-55183 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 10.0
CVE-2025-55183 [CRITICAL] CVE-2025-55183 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-55183 :
React Server Components vulnerability analysis and mitigation
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
Source : NVD
## 5.3
Score
Published December 11, 2025
Severity MEDIUM
CNA Score 5.3
High-profile Vulnerability Yes
Affected Technologies
React Server Components
Next.js
Ha
Wiz
CVE-2025-55184 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 10.0
CVE-2025-55184 [CRITICAL] CVE-2025-55184 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-55184 :
React Server Components vulnerability analysis and mitigation
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Source : NVD
## 7.5
Score
Published December 11, 2025
Severity HIGH
CNA Score 7.5
High-profile Vulnerability Yes
Affected Technologies
React Server Components
Next.js
Has Public Exploit Yes
Has CISA KEV Exploit N
Wiz
CVE-2026-23864 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 10.0
CVE-2026-23864 [CRITICAL] CVE-2026-23864 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23864 :
React Server Components vulnerability analysis and mitigation
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
Source : NVD
## 7.5
Score
Published January 26, 2026
Severity HIGH
Wiz
CVE-2025-68155 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2025-68155 [MEDIUM] CVE-2025-68155 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68155 :
Vite RSC Plugin vulnerability analysis and mitigation
/__vite_rsc_findSourceMapURL
@vitejs/plugin-rsc
file://
filename
Source : NVD
## 7.5
Score
Published December 16, 2025
Severity HIGH
CNA Score 7.5
Affected Technologies
Vite RSC Plugin
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 67.7
Exploitation Probability (EPSS) 0.5
Affected packages and libraries
@vitejs/plugin-rsc
Sources
NVD
npm Severity HIGH Has Fix Added at: Dec 17, 2025
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Vite RSC Plugin vulnerabilities:
CVE ID
Severity
Score
Technologi
2025-12-11
Published