CVE-2025-55183
CVE-2025-55183
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
CVSS 5.3 · Medium · EPSS 64.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
react-server-dom-webpack
- Versions
- ≥ 19.0.0, ≤ 19.0.1: Affected (semver)
- ≥ 19.1.0, ≤ 19.1.2: Affected (semver)
- ≥ 19.2.0, ≤ 19.2.1: Affected (semver)
No fix published
react-server-dom-turbopack
- Versions
- ≥ 19.0.0, ≤ 19.0.1: Affected (semver)
- ≥ 19.1.0, ≤ 19.1.2: Affected (semver)
- ≥ 19.2.0, ≤ 19.2.1: Affected (semver)
No fix published
react-server-dom-parcel
- Versions
- ≥ 19.0.0, ≤ 19.0.1: Affected (semver)
- ≥ 19.1.0, ≤ 19.1.2: Affected (semver)
- ≥ 19.2.0, ≤ 19.2.1: Affected (semver)
No fix published
react-server-dom-parcel npm
- Affected ranges
- SEMVER: ≥ 19.0.0, < 19.0.2
Update to 19.0.2
react-server-dom-turbopack npm
- Affected ranges
- SEMVER: ≥ 19.0.0, < 19.0.2
Update to 19.0.2
react-server-dom-webpack npm
- Affected ranges
- SEMVER: ≥ 19.0.0, < 19.0.2
Update to 19.0.2
react-server-dom-parcel npm
- Affected ranges
- SEMVER: ≥ 19.1.0, < 19.1.3
Update to 19.1.3
react-server-dom-parcel npm
- Affected ranges
- SEMVER: ≥ 19.2.0, < 19.2.2
Update to 19.2.2
react-server-dom-turbopack npm
- Affected ranges
- SEMVER: ≥ 19.1.0, < 19.1.3
Update to 19.1.3
react-server-dom-turbopack npm
- Affected ranges
- SEMVER: ≥ 19.2.0, < 19.2.2
Update to 19.2.2
react-server-dom-webpack npm
- Affected ranges
- SEMVER: ≥ 19.1.0, < 19.1.3
Update to 19.1.3
react-server-dom-webpack npm
- Affected ranges
- SEMVER: ≥ 19.2.0, < 19.2.2
Update to 19.2.2