5.3
Medium
CVE-2025-55183 An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1…
Description
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| react-server-dom-webpack 19.2 | 19.2.0 → 19.2.1 | No fix stated |
| react-server-dom-webpack 19.1 | 19.1.0 → 19.1.2 | No fix stated |
| react-server-dom-webpack 19.0 | 19.0.0 → 19.0.1 | No fix stated |
| react-server-dom-turbopack 19.2 | 19.2.0 → 19.2.1 | No fix stated |
| react-server-dom-turbopack 19.1 | 19.1.0 → 19.1.2 | No fix stated |
| react-server-dom-turbopack 19.0 | 19.0.0 → 19.0.1 | No fix stated |
| react-server-dom-parcel 19.2 | 19.2.0 → 19.2.1 | No fix stated |
| react-server-dom-parcel 19.1 | 19.1.0 → 19.1.2 | No fix stated |
| react-server-dom-parcel 19.0 | 19.0.0 → 19.0.1 | No fix stated |
Other CVEs of react-server-dom-webpack
The 8 CVEs of react-server-dom-webpack →
CVE-2026-44907
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function…
7.5
High
CVE-2026-23870
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function…
7.5
High
CVE-2026-23869
A denial of service vulnerability exists in React Server Components, affecting the following packages:…
7.5
High
CVE-2026-23864
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages:…
7.5
High