Patchfirst
Patchfirst
CVE-2025-55183 Public exploit Medium · 5.3 EPSS 64.2%

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1…

Meta · react-server-dom-webpack

Summary

The react-server-dom-webpack component of Meta's React Server Components, along with the related react-server-dom-parcel and react-server-dom-turbopack packages, contains an information leak flaw affecting React 19.0.0 through 19.2.1 in specific configurations. An unauthenticated remote attacker can send a specially crafted HTTP request to a vulnerable Server Function, which may cause it to unsafely return the source code of any Server Function, but only where a Server Function explicitly or implicitly exposes a stringified argument.

Official description · CVE.org

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

Breakdown
30.6 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (PoC-in-GitHub) was available the same day.

  1. DisclosedPublic exploit codePoC-in-GitHubday 0

5 fixes in react-server-dom-webpack over 8 weeks. The latest fix listed for react-server-dom-webpack is 19.2.4.

Fixes in react-server-dom-webpacknpm package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 19.2.1CVE-2025-551823 Dec 2025KEV
  2. 19.2.2CVE-2025-5518311 Dec 2025
  3. 19.2.2CVE-2025-5518411 Dec 2025
  4. 19.2.3CVE-2025-6777911 Dec 2025
  5. 19.2.4CVE-2026-2386426 Jan 2026Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

3 packages in 1 ecosystem. Main package: react-server-dom-webpack.

npmreact-server-dom-webpackGHSA-925w-6v3x-g4j4

Upgrade to 19.2.2 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2025-55182, CVE-2025-55184).

npmnpm install react-server-dom-webpack@19.2.2

The first fix for CVE-2025-55183.

Affected versions, by release line

If you runUpgrade to
19.2.0 up to 19.2.219.2.2
19.1.0 up to 19.1.319.1.3
19.0.0 up to 19.0.219.0.2

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (2)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

  • npmreact-server-dom-parcel
    Affected: 19.2.0 up to 19.2.2; 19.1.0 up to 19.1.3; 19.0.0 up to 19.0.2Upgrade to 19.2.2 or later (older lines: 19.1.3, 19.0.2)
    GHSA-925w-6v3x-g4j4
  • npmreact-server-dom-turbopack
    Affected: 19.2.0 up to 19.2.2; 19.1.0 up to 19.1.3; 19.0.0 up to 19.0.2Upgrade to 19.2.2 or later (older lines: 19.1.3, 19.0.2)
    GHSA-925w-6v3x-g4j4

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 7 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

x_refsource_CONFIRM 2

facebook.com/security/advisories/cve-2025-55183react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
↑ ↓ chooseEnter openEsc close