{"id":"CVE-2025-55183","state":"PUBLISHED","title":"An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the foll","description":"An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.","publishedAt":"2025-12-11T20:04:48.655Z","updatedAt":"2026-01-07T16:26:47.826Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"Meta"},"assigner":"Meta","products":["Meta react-server-dom-webpack","Meta react-server-dom-turbopack","Meta react-server-dom-parcel"],"affected":[{"vendor":"Meta","product":"react-server-dom-webpack","defaultStatus":"unaffected","versions":[{"version":"19.0.0","status":"affected","lessThanOrEqual":"19.0.1","versionType":"semver"},{"version":"19.1.0","status":"affected","lessThanOrEqual":"19.1.2","versionType":"semver"},{"version":"19.2.0","status":"affected","lessThanOrEqual":"19.2.1","versionType":"semver"}]},{"vendor":"Meta","product":"react-server-dom-turbopack","defaultStatus":"unaffected","versions":[{"version":"19.0.0","status":"affected","lessThanOrEqual":"19.0.1","versionType":"semver"},{"version":"19.1.0","status":"affected","lessThanOrEqual":"19.1.2","versionType":"semver"},{"version":"19.2.0","status":"affected","lessThanOrEqual":"19.2.1","versionType":"semver"}]},{"vendor":"Meta","product":"react-server-dom-parcel","defaultStatus":"unaffected","versions":[{"version":"19.0.0","status":"affected","lessThanOrEqual":"19.0.1","versionType":"semver"},{"version":"19.1.0","status":"affected","lessThanOrEqual":"19.1.2","versionType":"semver"},{"version":"19.2.0","status":"affected","lessThanOrEqual":"19.2.1","versionType":"semver"}]}],"references":["https://www.facebook.com/security/advisories/cve-2025-55183","https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:31.862Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/55xxx/CVE-2025-55183.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-55183","state":"PUBLISHED","datePublished":"2025-12-11T20:04:48.655Z","dateUpdated":"2026-01-07T16:26:47.826Z","assignerShortName":"Meta","assignerOrgId":"4fc57720-52fe-4431-a0fb-3d2c8747b827","dateReserved":"2025-08-08T18:21:47.119Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument."}],"affected":[{"vendor":"Meta","product":"react-server-dom-webpack","defaultStatus":"unaffected","versions":[{"version":"19.0.0","status":"affected","lessThanOrEqual":"19.0.1","versionType":"semver"},{"version":"19.1.0","status":"affected","lessThanOrEqual":"19.1.2","versionType":"semver"},{"version":"19.2.0","status":"affected","lessThanOrEqual":"19.2.1","versionType":"semver"}]},{"vendor":"Meta","product":"react-server-dom-turbopack","defaultStatus":"unaffected","versions":[{"version":"19.0.0","status":"affected","lessThanOrEqual":"19.0.1","versionType":"semver"},{"version":"19.1.0","status":"affected","lessThanOrEqual":"19.1.2","versionType":"semver"},{"version":"19.2.0","status":"affected","lessThanOrEqual":"19.2.1","versionType":"semver"}]},{"vendor":"Meta","product":"react-server-dom-parcel","defaultStatus":"unaffected","versions":[{"version":"19.0.0","status":"affected","lessThanOrEqual":"19.0.1","versionType":"semver"},{"version":"19.1.0","status":"affected","lessThanOrEqual":"19.1.2","versionType":"semver"},{"version":"19.2.0","status":"affected","lessThanOrEqual":"19.2.1","versionType":"semver"}]}],"references":[{"url":"https://www.facebook.com/security/advisories/cve-2025-55183","tags":["x_refsource_CONFIRM"]},{"url":"https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components","tags":["x_refsource_CONFIRM"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"description":"(CWE-502) Deserialization of Untrusted Data. (CWE-497) Exposure of Sensitive System Information to an Unauthorized Actor","lang":"en"}]}],"providerMetadata":{"shortName":"Meta","orgId":"4fc57720-52fe-4431-a0fb-3d2c8747b827","dateUpdated":"2025-12-11T20:09:32.286Z"},"dateAssigned":"2025-12-09T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-07T16:24:47.971492Z","id":"CVE-2025-55183","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-07T16:26:47.826Z"}}]}}}