Vulnerability

CERT-In Vulnerability Note CIVN-2025-0383
Multiple vulnerabilities in React Server Components

Original Issue Date:December 24, 2025

Severity Rating: HIGH

Software Affected

react-server-dom-webpack versions prior to 19.0.3, 19.1.4 and 19.2.3.
react-server-dom-parcel versions prior to 19.0.3, 19.1.4 and 19.2.3.
react-server-dom-turbopack versions prior to 19.0.3, 19.1.4 and 19.2.3.

Overview

Multiple vulnerabilities have been identified in React Server Components (RSC) that could allow attackers to perform denial-of-service (DoS) attacks or obtain sensitive source code and application data.

Target Audience:
All end-user organizations and individuals using React Server Components.

Impact Assessment:
High risk of service disruption and information disclosure.

Description

React Server Components (RSC) is a framework feature that allows server-side execution of React components to reduce client-side JavaScript and improve rendering performance.

These vulnerabilities exist in React Server Components (RSC) due to improper handling of stringified arguments in HTTP requests sent to Server Function (Server Action) endpoints. An attacker could exploit this behaviour by issuing specially crafted HTTP requests to a vulnerable server.

Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive information and cause denial of service condition on the targeted system.

Solution

https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

Vendor Information

React
https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

References

React
https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

CVE Name
CVE-2025-55184
CVE-2025-67779
CVE-2025-55183

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India