Skip to content
fr Sign in
5.3 Medium

CVE-2025-55183 An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1…

Description

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

Affected products and versions

Product Affected versions Fixed in
react-server-dom-webpack 19.2 19.2.0 → 19.2.1 No fix stated
react-server-dom-webpack 19.1 19.1.0 → 19.1.2 No fix stated
react-server-dom-webpack 19.0 19.0.0 → 19.0.1 No fix stated
react-server-dom-turbopack 19.2 19.2.0 → 19.2.1 No fix stated
react-server-dom-turbopack 19.1 19.1.0 → 19.1.2 No fix stated
react-server-dom-turbopack 19.0 19.0.0 → 19.0.1 No fix stated
react-server-dom-parcel 19.2 19.2.0 → 19.2.1 No fix stated
react-server-dom-parcel 19.1 19.1.0 → 19.1.2 No fix stated
react-server-dom-parcel 19.0 19.0.0 → 19.0.1 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of react-server-dom-webpack

The 8 CVEs of react-server-dom-webpack →
CVE-2026-44907 A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function… 7.5 High CVE-2026-23870 A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function… 7.5 High CVE-2026-23869 A denial of service vulnerability exists in React Server Components, affecting the following packages:… 7.5 High CVE-2026-23864 Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages:… 7.5 High
Track this CVE