CVE-2025-55183

mediumpriority · track · 32EPSS 0.642 · 99 %ileexploit · PoCDEEUNLUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

6 exploits · PoC

Likely / severe?

64.2% (99th) EPSS

CVSS 5.3 · medium

Is it mine?

59 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · ncsc_nl

EPSS · scored 2026-10-26

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · cve-assign@fb.comexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · OSV

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:Hsecondary · CVSS-BT (t0sche)

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-497USCWE-497USCWE-502US

exploits (6)

Public proof-of-concept and weaponised exploit code.

Saturate/CVE-2025-55183A CVE-2025-55183 secret minerPoC · poc_in_github
StealthMoud/react-server-cve-labSecurity research lab for CVE-2025-55183 and CVE-2025-55184 in React Server ComponentsPoC · poc_in_github
X-Cotang/CVE-2025-55183_POCCVE-2025-55183 POCPoC · poc_in_github
kimtruth/CVE-2025-55183-pocPoC for CVE-2025-55183PoC · poc_in_github
omaidnebari/RSC-Scanner-POCCVE-2025-55183 ScannerPoC · poc_in_github
williavs/nextjs-security-updateBatch upgrade all your Next.js apps to patched versions - fight back against CVE-2025-55183/55184/67779PoC · poc_in_github

affected products (59)

Products and version ranges known to be affected.

Open Source React <19.0.3all versionscert_bundDE
Open Source React <19.1.4all versionscert_bundDE
Open Source React <19.2.3all versionscert_bundDE
Vercel Next.js <14.2.35all versionscert_bundDE
Vercel Next.js <15.0.7all versionscert_bundDE
Vercel Next.js <15.1.11all versionscert_bundDE
Vercel Next.js <15.2.8all versionscert_bundDE
Vercel Next.js <15.3.8all versionscert_bundDE
Vercel Next.js <15.4.10all versionscert_bundDE
Vercel Next.js <15.5.9all versionscert_bundDE
Vercel Next.js <15.6.0-canary.60all versionscert_bundDE
Vercel Next.js <16.0.10all versionscert_bundDE
Vercel Next.js <16.1.0-canary.19all versionscert_bundDE
Open Source React< 19.0.3cert_bundDE
Open Source React< 19.1.4cert_bundDE
Open Source React< 19.2.3cert_bundDE
vercel next.js< 14.2.35cert_bundDE
vercel next.js< 15.0.7cert_bundDE
vercel next.js< 15.1.11cert_bundDE
vercel next.js< 15.2.8cert_bundDE

showing 20 of 59

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2025-0394Kwetsbaarheden verholpen in React Server ComponentsNL2025-12-12csaf · ncsc_nlNL
Meta heeft kwetsbaarheden verholpen in React Server Components Parcel, Turbopack en Webpack.
WID-SEC-W-2025-2835Vercel Next.js und React Server Components: Mehrere SchwachstellenDeutsch2025-12-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js und React Server Components ausnutzen, um Informationen offenzulegen und um einen Denial of Service Angriff durchzuführen.
GHSA-925w-6v3x-g4j4Source Code Exposure Vulnerability in React Server Components2025-12-11ghsa · osvUS
## Impact There is a source code exposure vulnerability in React Server Components. React recommends updating immediately. The vulnerability exists in versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of: - [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) - [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) - [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme) These issues are present in the patches published last week. ## Patches Fixes were back ported to versions 19.0.2, 19.1.3, and 19.2.2. If you are using any of the above packages please upgrade to any of the fixed versions immediately. If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability. ## References See the [blog post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more information and upgrade instructions.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund ncsc_nl osv NVD CVE.org MITRE

published 2025-12-11modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan