{"id":"CVE-2025-55183","published":"2025-12-11T20:04:48Z","modified":"2026-01-07T16:26:47Z","title":"An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1…","vendor":"Meta","product":"react-server-dom-webpack","tier":"core","eol":null,"affectedVersions":[{"vendor":"Meta","product":"react-server-dom-webpack","versions":[">= 19.0.0, <= 19.0.1",">= 19.1.0, <= 19.1.2",">= 19.2.0, <= 19.2.1"]},{"vendor":"Meta","product":"react-server-dom-turbopack","versions":[">= 19.0.0, <= 19.0.1",">= 19.1.0, <= 19.1.2",">= 19.2.0, <= 19.2.1"]},{"vendor":"Meta","product":"react-server-dom-parcel","versions":[">= 19.0.0, <= 19.0.1",">= 19.1.0, <= 19.1.2",">= 19.2.0, <= 19.2.1"]}],"description":{"text":"An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.","provenance":"source","from":"CVE.org"},"summary":{"text":"The react-server-dom-webpack component of Meta's React Server Components, along with the related react-server-dom-parcel and react-server-dom-turbopack packages, contains an information leak flaw affecting React 19.0.0 through 19.2.1 in specific configurations. An unauthenticated remote attacker can send a specially crafted HTTP request to a vulnerable Server Function, which may cause it to unsafely return the source code of any Server Function, but only where a Server Function explicitly or implicitly exposes a stringified argument.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:04Z"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.64233,"percentile":0.99228,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":7,"pulses":[{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - April 2026","url":"https://otx.alienvault.com/pulse/6a04aeed763730d81a39cece","created":"2026-05-13"},{"name":"Credential Stuffing & C2 Config: AREK-BTC Variant (Zeppelin-Linked)","url":"https://otx.alienvault.com/pulse/69a145ba89a2b4af5a0aa721","created":"2026-02-27"},{"name":"Weekly Threat Bulletin – January 28th, 2026","url":"https://otx.alienvault.com/pulse/697ae2da32ab2efc29be04aa","created":"2026-01-29"},{"name":"Weekly Threat Bulletin – January 28th, 2026","url":"https://otx.alienvault.com/pulse/697a0fb2c327ef769cb46467","created":"2026-01-28"},{"name":"Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)","url":"https://otx.alienvault.com/pulse/6940e587f54477fc54ec53e0","created":"2025-12-16"},{"name":"Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)","url":"https://otx.alienvault.com/pulse/693dbc770dda63b6789c82b1","created":"2025-12-13"},{"name":"Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)","url":"https://otx.alienvault.com/pulse/693d41e31912ac329def62a6","created":"2025-12-13"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.facebook.com/security/advisories/cve-2025-55183","tags":["x_refsource_CONFIRM"]},{"url":"https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"npm","package":"react-server-dom-parcel","vulnerableRanges":[">=19.0.0, <19.0.2",">=19.1.0, <19.1.3",">=19.2.0, <19.2.2"],"patched":["19.0.2","19.1.3","19.2.2"],"from":["GHSA-925w-6v3x-g4j4"],"provenance":"source"},{"ecosystem":"npm","package":"react-server-dom-turbopack","vulnerableRanges":[">=19.0.0, <19.0.2",">=19.1.0, <19.1.3",">=19.2.0, <19.2.2"],"patched":["19.0.2","19.1.3","19.2.2"],"from":["GHSA-925w-6v3x-g4j4"],"provenance":"source"},{"ecosystem":"npm","package":"react-server-dom-webpack","vulnerableRanges":[">=19.0.0, <19.0.2",">=19.1.0, <19.1.3",">=19.2.0, <19.2.2"],"patched":["19.0.2","19.1.3","19.2.2"],"from":["GHSA-925w-6v3x-g4j4"],"provenance":"source"}],"advisories":[{"id":"GHSA-925w-6v3x-g4j4","url":"https://github.com/advisories/GHSA-925w-6v3x-g4j4","severity":"MODERATE","ecosystem":"npm","package":"react-server-dom-parcel","vulnerableRanges":[">=19.0.0, <19.0.2"],"patched":["19.0.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-925w-6v3x-g4j4","url":"https://github.com/advisories/GHSA-925w-6v3x-g4j4","severity":"MODERATE","ecosystem":"npm","package":"react-server-dom-turbopack","vulnerableRanges":[">=19.0.0, <19.0.2"],"patched":["19.0.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-925w-6v3x-g4j4","url":"https://github.com/advisories/GHSA-925w-6v3x-g4j4","severity":"MODERATE","ecosystem":"npm","package":"react-server-dom-webpack","vulnerableRanges":[">=19.0.0, <19.0.2"],"patched":["19.0.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-925w-6v3x-g4j4","url":"https://github.com/advisories/GHSA-925w-6v3x-g4j4","severity":"MODERATE","ecosystem":"npm","package":"react-server-dom-parcel","vulnerableRanges":[">=19.1.0, <19.1.3"],"patched":["19.1.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-925w-6v3x-g4j4","url":"https://github.com/advisories/GHSA-925w-6v3x-g4j4","severity":"MODERATE","ecosystem":"npm","package":"react-server-dom-parcel","vulnerableRanges":[">=19.2.0, <19.2.2"],"patched":["19.2.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-925w-6v3x-g4j4","url":"https://github.com/advisories/GHSA-925w-6v3x-g4j4","severity":"MODERATE","ecosystem":"npm","package":"react-server-dom-turbopack","vulnerableRanges":[">=19.1.0, <19.1.3"],"patched":["19.1.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-925w-6v3x-g4j4","url":"https://github.com/advisories/GHSA-925w-6v3x-g4j4","severity":"MODERATE","ecosystem":"npm","package":"react-server-dom-turbopack","vulnerableRanges":[">=19.2.0, <19.2.2"],"patched":["19.2.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-925w-6v3x-g4j4","url":"https://github.com/advisories/GHSA-925w-6v3x-g4j4","severity":"MODERATE","ecosystem":"npm","package":"react-server-dom-webpack","vulnerableRanges":[">=19.1.0, <19.1.3"],"patched":["19.1.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-925w-6v3x-g4j4","url":"https://github.com/advisories/GHSA-925w-6v3x-g4j4","severity":"MODERATE","ecosystem":"npm","package":"react-server-dom-webpack","vulnerableRanges":[">=19.2.0, <19.2.2"],"patched":["19.2.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-202879","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202879","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":0,"earliest":"2025-12-11","earliestUrl":"https://github.com/Saturate/CVE-2025-55183","repos":[{"name":"williavs/nextjs-security-update","url":"https://github.com/williavs/nextjs-security-update","stars":8,"created":"2025-12-12"},{"name":"kimtruth/CVE-2025-55183-poc","url":"https://github.com/kimtruth/CVE-2025-55183-poc","stars":7,"created":"2025-12-12"},{"name":"StealthMoud/react-server-cve-lab","url":"https://github.com/StealthMoud/react-server-cve-lab","stars":5,"created":"2025-12-12"},{"name":"X-Cotang/CVE-2025-55183_POC","url":"https://github.com/X-Cotang/CVE-2025-55183_POC","stars":4,"created":"2025-12-12"},{"name":"Saturate/CVE-2025-55183","url":"https://github.com/Saturate/CVE-2025-55183","stars":2,"created":"2025-12-11"}]},"first":{"date":"2025-12-11","source":"PoC-in-GitHub","url":"https://github.com/Saturate/CVE-2025-55183"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-12-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-55183","provenance":"source"},{"date":"2025-12-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Saturate/CVE-2025-55183","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":30.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.85,"detail":"percentile 0.9923"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"6 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.05,"detail":"7 pulses"},{"name":"CVSS severity","points":3.71,"detail":"base score 5.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2025-55182","published":"2025-12-03","fixed":"19.2.1","kev":true,"link":{"from":"CVE-2025-55182","to":"CVE-2025-55183","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:react-server-dom-webpack","fromFixed":"19.0.1","toFixed":"19.0.2","daysApart":8},{"kind":"version-step","provenance":"source","package":"npm:react-server-dom-turbopack","fromFixed":"19.0.1","toFixed":"19.0.2","daysApart":8}]}},{"cve":"CVE-2025-55183","published":"2025-12-11","fixed":"19.2.2","kev":false},{"cve":"CVE-2025-55184","published":"2025-12-11","fixed":"19.2.2","kev":false},{"cve":"CVE-2025-67779","published":"2025-12-11","fixed":"19.2.3","kev":false},{"cve":"CVE-2026-23864","published":"2026-01-26","fixed":"19.2.4","kev":false}],"package":"npm:react-server-dom-webpack"}}