GHSA-fmh4-wr37-44fp
React Server Components are Vulnerable to RCE
Summary
@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained an unauthenticated remote code execution vulnerability in versions prior to 19.0.1, 19.1.2, and 19.2.1. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
Impact
Applications using affected versions of @vitejs/plugin-rsc are vulnerable to unauthenticated remote code execution through deserialization of untrusted data. An attacker can execute arbitrary code remotely without authentication, affecting confidentiality, integrity, and availability.
Recommendations
Upgrade immediately to @vitejs/plugin-rsc@0.5.3 or later.
Workarounds
Applications not using server-side React or React Server Components are unaffected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score used
React Server Components are Vulnerable to RCE
Summary
@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained an unauthenticated remote code execution vulnerability in versions prior to 19.0.1, 19.1.2, and 19.2.1. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
Impact
Applications using affected versions of @vitejs/plugin-rsc are vulnerable to unauthenticated remote code execution through deserialization of untrusted data. An attacker can execute arbitrary code remotely without authentication, affecting confidentiality, integrity, and availability.
Recommendations
Upgrade immediately to @vitejs/plugin-rsc@0.5.3 or later.
Workarounds
Applications not using server-side React or React Server Components are unaffected.
- Record
GHSA-fmh4-wr37-44fp- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
React Server Components are Vulnerable to RCE
Summary
@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained an unauthenticated remote code execution vulnerability in versions prior to 19.0.1, 19.1.2, and 19.2.1. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
Impact
Applications using affected versions of @vitejs/plugin-rsc are vulnerable to unauthenticated remote code execution through deserialization of untrusted data. An attacker can execute arbitrary code remotely without authentication, affecting confidentiality, integrity, and availability.
Recommendations
Upgrade immediately to @vitejs/plugin-rsc@0.5.3 or later.
Workarounds
Applications not using server-side React or React Server Components are unaffected.
- Record
GHSA-fmh4-wr37-44fp- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@vitejs/plugin-rscnpm | through 0.5.2 | 0.5.3 |
@vitejs/plugin-rscnpm | before 0.5.3 | 0.5.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-fmh4-wr37-44fp is a critical vulnerability (CVSS 10.0) in @vitejs/plugin-rsc, published December 3, 2025. No source lists public exploit code. Fixed in @vitejs/plugin-rsc 0.5.3.
References
github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components