{"id":"EUVD-2025-202879","enisaUuid":"fe3099df-ea7c-3bd8-a60e-84cf26f6b23e","description":"An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.","datePublished":"Dec 11, 2025, 8:04:48 PM","dateUpdated":"Jan 7, 2026, 4:26:47 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://www.facebook.com/security/advisories/cve-2025-55183\nhttps://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components\n","aliases":"CVE-2025-55183\nGHSA-925w-6v3x-g4j4\n","assigner":"Meta","epss":64.23,"enisaIdProduct":[{"id":"16307d5b-94e0-320a-983f-ee1a726f678a","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.2"},{"id":"1fdb873b-0c6f-3444-bb3e-021ca9806b6b","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.1"},{"id":"2733a1a7-ea3b-3460-b080-f7e725cb6e75","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.1"},{"id":"38c249b0-8c70-3eb0-9bfb-23dea4303a3b","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.1"},{"id":"6f06910e-a757-328d-8bc4-377110e5dd63","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.1"},{"id":"7b49e2e6-3201-3292-9214-df32404f337e","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.1"},{"id":"f76373f1-c1cc-3f28-8b86-7178b3e89cbc","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.2"},{"id":"f96bc118-8096-3d42-a8f0-b416f0c6071d","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.1"},{"id":"fb4fcdd8-c9e4-3358-bb70-c1656d7d4bd2","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.2"}],"enisaIdVendor":[{"id":"dd2263ea-af77-3d41-8eee-3363f59915a2","vendor":{"name":"Meta"}}],"enisaIdVulnerability":[{"id":"86f3fe02-337f-3c55-af91-c9c8e30eb451","vulnerability":{"id":"CVE-2025-55183","description":"An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.","datePublished":"Dec 11, 2025, 8:04:48 PM","dateUpdated":"Jan 7, 2026, 4:26:47 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://www.facebook.com/security/advisories/cve-2025-55183\nhttps://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components\n","enisa_id":"EUVD-2025-202879\n","assigner":"Meta","epss":64.23,"dataProcessed":"Nov 6, 2026, 7:13:53 AM","vulnerabilityProduct":[{"id":"201d2d6c-58ad-3905-a303-a3c9623dd4c0","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.1"},{"id":"3394dd78-eca0-30d5-99f5-93dabd721f10","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.1"},{"id":"46a22544-2bd4-3ae6-8e1f-b0a6ab0e62ba","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.1"},{"id":"4b557281-a9da-3c3a-905d-59a07720fee8","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.2"},{"id":"68f73dc8-6c24-37c3-87cd-0f4223dc11e8","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.2"},{"id":"741946d7-7190-3f7c-8f75-8e913f2d11c5","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.1"},{"id":"87ae4ea7-45d9-3574-ada2-46b576854d92","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.2"},{"id":"9d1ca752-192c-3077-ac08-63110abaf17c","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.1"},{"id":"bc806b53-07d6-3067-8782-3e89d0babe7f","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.1"}],"vulnerabilityVendor":[{"id":"f191852b-ec6d-3646-a271-701b6323c491","vendor":{"name":"Meta"}}]}},{"id":"b163da20-d6b0-3245-b12e-1137e6f7157f","vulnerability":{"id":"GHSA-925w-6v3x-g4j4","description":"Source Code Exposure Vulnerability in React Server Components","datePublished":"Dec 11, 2025, 10:36:08 PM","dateUpdated":"Dec 11, 2025, 10:36:08 PM","baseScore":0.0,"references":"https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-55183\nhttps://github.com/facebook/react\nhttps://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components\nhttps://www.facebook.com/security/advisories/cve-2025-55183\n","enisa_id":"EUVD-2025-202879\n","aliases":"GHSA-925w-6v3x-g4j4\nCVE-2025-55183\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"37a64b8f-2d05-34af-bacd-48c9c2d86642","advisory":{"id":"NCSC-2025-0394","description":"Kwetsbaarheden verholpen in React Server Components","datePublished":"Dec 12, 2025, 9:04:19 AM","dateUpdated":"Dec 12, 2025, 10:46:34 AM","baseScore":0.0,"references":"","aliases":"CVE-2025-67779\nCVE-2025-55183\nCVE-2025-55184\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"023cae77-cc29-3da8-91e3-411d216361d7","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}}},{"id":"8d6c583b-3df6-3d91-898f-2bde4a061614","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}}},{"id":"8ea15e91-418c-3881-a6f4-ac2b0c3ba239","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}}},{"id":"dcbbf9f7-a69c-32aa-ae87-c66c73657ae7","product":{"name":"vers:unknown/*","vendor":{"name":"Cisco"}}}]}}]}