Every CVE Search/ Get API key

CVE-2025-55183

Source Code Exposure Vulnerability in React Server Components

5.3 MediumPublic exploitFix available

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

64.2%Up 64.2 points since Dec 12, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.3

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

Record
CVE-2025-55183
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
EUVDEUVD-2025-202879 5.3

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

Record
EUVD-2025-202879
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-925w-6v3x-g4j4 5.3

Source Code Exposure Vulnerability in React Server Components

Impact

There is a source code exposure vulnerability in React Server Components.

React recommends updating immediately.

The vulnerability exists in versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of:

These issues are present in the patches published last week.

Patches

Fixes were back ported to versions 19.0.2, 19.1.3, and 19.2.2.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References

See the blog post for more information and upgrade instructions.

Record
GHSA-925w-6v3x-g4j4
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-497, CWE-502
Updated
2026-11-02
NVD 5.3

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

Record
CVE-2025-55183
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSV 5.3

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

Record
CVE-2025-55183
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVGHSA-925w-6v3x-g4j4 5.3

Source Code Exposure Vulnerability in React Server Components

Impact

There is a source code exposure vulnerability in React Server Components.

React recommends updating immediately.

The vulnerability exists in versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of:

These issues are present in the patches published last week.

Patches

Fixes were back ported to versions 19.0.2, 19.1.3, and 19.2.2.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References

See the blog post for more information and upgrade instructions.

Record
GHSA-925w-6v3x-g4j4
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-497, CWE-502
Updated
2026-11-02
Show 11 moreShow less
OSVCLSA-2026-1787663916 No score

TuxCare security update for 13 packages (2 CVEs)

TuxCare rebuilt 13 packages to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.

Record
CLSA-2026-1787663916
Updated
2026-11-02
OSVCLSA-2026-1792195753 No score

TuxCare security update for create-next-app (2 CVEs)

TuxCare rebuilt create-next-app to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.

Record
CLSA-2026-1792195753
Updated
2026-11-02
OSVCLSA-2026-1792196880 No score

TuxCare security update for @next/eslint-plugin-next (2 CVEs)

TuxCare rebuilt @next/eslint-plugin-next to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.

Record
CLSA-2026-1792196880
Updated
2026-11-02
OSVCLSA-2026-1792206307 No score

TuxCare security update for @next/bundle-analyzer (2 CVEs)

TuxCare rebuilt @next/bundle-analyzer to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.

Record
CLSA-2026-1792206307
Updated
2026-11-02
OSVCLSA-2026-1792272248 No score

TuxCare security update for @next/plugin-storybook (2 CVEs)

TuxCare rebuilt @next/plugin-storybook to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.

Record
CLSA-2026-1792272248
Updated
2026-11-02
OSVCLSA-2026-1792293003 No score

TuxCare security update for @next/polyfill-module (2 CVEs)

TuxCare rebuilt @next/polyfill-module to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.

Record
CLSA-2026-1792293003
Updated
2026-11-02
OSVCLSA-2026-1792304743 No score

TuxCare security update for @next/polyfill-nomodule (2 CVEs)

TuxCare rebuilt @next/polyfill-nomodule to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.

Record
CLSA-2026-1792304743
Updated
2026-11-02
OSVCLSA-2026-1792326306 No score

TuxCare security update for @next/react-refresh-utils (2 CVEs)

TuxCare rebuilt @next/react-refresh-utils to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.

Record
CLSA-2026-1792326306
Updated
2026-11-02
OSVCLSA-2026-1792338239 No score

TuxCare security update for @next/third-parties (2 CVEs)

TuxCare rebuilt @next/third-parties to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.

Record
CLSA-2026-1792338239
Updated
2026-11-02
OSVCLSA-2026-1792358600 No score

TuxCare security update for @next/codemod (2 CVEs)

TuxCare rebuilt @next/codemod to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.

Record
CLSA-2026-1792358600
Updated
2026-11-02
OSVCLSA-2026-1792364007 No score

TuxCare security update for @next/mdx (2 CVEs)

TuxCare rebuilt @next/mdx to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.

Record
CLSA-2026-1792364007
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
react-server-dom-parcel
npm
 19.0.0 up to 19.0.2
19.0.2
react-server-dom-turbopack
npm
 19.0.0 up to 19.0.2
19.0.2
react-server-dom-webpack
npm
 19.0.0 up to 19.0.2
19.0.2
react-server-dom-parcel
npm
 19.1.0 up to 19.1.3
19.1.3
react-server-dom-parcel
npm
 19.2.0 up to 19.2.2
19.2.2
react-server-dom-turbopack
npm
 19.1.0 up to 19.1.3
19.1.3
react-server-dom-turbopack
npm
 19.2.0 up to 19.2.2
19.2.2
react-server-dom-webpack
npm
 19.1.0 up to 19.1.3
19.1.3
react-server-dom-webpack
npm
 19.2.0 up to 19.2.2
19.2.2
create-next-app
TuxCare:npm
From an advisory covering 2 CVEs
 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions
13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14
13.5.11-tuxcare.16
Show 9 moreShow less
Affected packages
PackageAffectedFixed
@next/eslint-plugin-next
TuxCare:npm
From an advisory covering 2 CVEs
 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions
13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14
13.5.11-tuxcare.16
@next/bundle-analyzer
TuxCare:npm
From an advisory covering 2 CVEs
 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions
13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14
13.5.11-tuxcare.16
@next/plugin-storybook
TuxCare:npm
From an advisory covering 2 CVEs
 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions
13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14
13.5.11-tuxcare.16
@next/polyfill-module
TuxCare:npm
From an advisory covering 2 CVEs
 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions
13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14
13.5.11-tuxcare.16
@next/polyfill-nomodule
TuxCare:npm
From an advisory covering 2 CVEs
 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions
13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14
13.5.11-tuxcare.16
@next/react-refresh-utils
TuxCare:npm
From an advisory covering 2 CVEs
 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions
13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14
13.5.11-tuxcare.16
@next/third-parties
TuxCare:npm
From an advisory covering 2 CVEs
 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions
13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14
13.5.11-tuxcare.16
@next/codemod
TuxCare:npm
From an advisory covering 2 CVEs
 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions
13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14
13.5.11-tuxcare.16
@next/mdx
TuxCare:npm
From an advisory covering 2 CVEs
 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions
13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14
13.5.11-tuxcare.16

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubSaturate/CVE-2025-551832025-12-11
PoC in GitHubStealthMoud/react-server-cve-lab2025-12-12
PoC in GitHubX-Cotang/CVE-2025-55183_POC2025-12-12
PoC in GitHubkimtruth/CVE-2025-55183-poc2025-12-12
PoC in GitHubomaidnebari/RSC-Scanner-POC2025-12-12
PoC in GitHubwilliavs/nextjs-security-update2025-12-12

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-55183 is a medium vulnerability (CVSS 5.3) in Facebook React, published December 11, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 64.2%, the 99th percentile. Fixed in react-server-dom-parcel 19.0.2.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open