This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] React Server Components fixes 2 vulnerabilities
React versions 19.0.3, 19.1.4 and 19.2.3 fix 2 vulnerabilities in React Server Components (packages react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack) [1] discovered during analysis of the fix for the critical vulnerability CVE-2025-55182 of 3 December 2025 [2]. The affected frameworks are next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk [1]. Detailed information on the vulnerabilities and fixes can be found at [1].
An unauthenticated remote attacker can perform a DoS attack by sending specially crafted HTTP requests to any Server Functions endpoint. Applications supporting React Server Components may be vulnerable even if they do not implement any React Server Function endpoint [1][3]. The fix for the original CVE-2025-55184 [4] was insufficient [1].
The vulnerability is present in products:
- react-server-dom-webpack; >=19.0.0, <=19.0.2; >=19.1.0, <=19.1.3; >=19.2.0, <=19.2.2;
- react-server-dom-turbopack; >=19.0.0, <=19.0.2; >=19.1.0, <=19.1.3; >=19.2.0, <=19.2.2;
- react-server-dom-parcel; >=19.0.0, <=19.0.2; >=19.1.0, <=19.1.3; >=19.2.0, <=19.2.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-67779 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 11. 12. 2025.
Under certain conditions, an unauthenticated remote attacker can obtain the source code of any Server Function by sending a specially crafted HTTP request. This may lead to the disclosure of sensitive data if it is defined directly in the code (hardcoded secrets) [1].
The vulnerability is present in products:
- react-server-dom-webpack; >=19.0.0, <=19.0.2; >=19.1.0, <=19.1.3; >=19.2.0, <=19.2.2;
- react-server-dom-turbopack; >=19.0.0, <=19.0.2; >=19.1.0, <=19.1.3; >=19.2.0, <=19.2.2;
- react-server-dom-parcel; >=19.0.0, <=19.0.2; >=19.1.0, <=19.1.3; >=19.2.0, <=19.2.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2025-55183 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 11. 12. 2025.
Links
By CESNET, z.s.p.o. Michaela Ručková on 16. 12. 2025.