{"id":"EUVD-2025-202879","revision":"b0e9acaffdff4740865c4f13876bf33b","records":[{"revision":"b0e9acaffdff4740865c4f13876bf33b","observedAt":"2026-11-11T05:28:50.461+00:00","statement":{"source":"euvd","id":"EUVD-2025-202879","aliases":["CVE-2025-55183","GHSA-925w-6v3x-g4j4"],"title":"An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-tu…","description":"An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":null}],"references":["https://www.facebook.com/security/advisories/cve-2025-55183","https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202879","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 11, 2025, 8:04:48 PM","dateUpdated":"Jan 7, 2026, 4:26:47 PM"},"relatedAdvisories":[{"id":"NCSC-2025-0394","title":"Kwetsbaarheden verholpen in React Server Components","vulnerabilityIds":["CVE-2025-67779","CVE-2025-55183","CVE-2025-55184"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-202879","identifiers":["EUVD-2025-202879","CVE-2025-55183","GHSA-925w-6v3x-g4j4"]},"retained":false,"historicalAffected":[]}],"coverage":[]}