CVE-2025-55183 Source Code Exposure Vulnerability in React Server Components
Attackers can leak source code of Server Functions via crafted HTTP requests if specific argument exposure conditions are met in React Server Components.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55183?
CVE-2025-55183 is a medium-severity vulnerability in Vercel Next.js, published on 11 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
Which versions are affected by CVE-2025-55183?
18 open source packages ship an affected version, including react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
react-server-dom-parcel npm | From 19.0.0 | 19.0.2 |
react-server-dom-parcel npm | From 19.0.0 | 19.0.2 |
react-server-dom-parcel npm | From 19.1.0 | 19.1.3 |
react-server-dom-parcel npm | From 19.1.0 | 19.1.3 |
react-server-dom-parcel npm | From 19.2.0 | 19.2.2 |
react-server-dom-parcel npm | From 19.2.0 | 19.2.2 |
12 more packages
react-server-dom-turbopack npm | From 19.0.0 | 19.0.2 |
react-server-dom-turbopack npm | From 19.0.0 | 19.0.2 |
react-server-dom-turbopack npm | From 19.1.0 | 19.1.3 |
react-server-dom-turbopack npm | From 19.1.0 | 19.1.3 |
react-server-dom-turbopack npm | From 19.2.0 | 19.2.2 |
react-server-dom-turbopack npm | From 19.2.0 | 19.2.2 |
react-server-dom-webpack npm | From 19.0.0 | 19.0.2 |
react-server-dom-webpack npm | From 19.0.0 | 19.0.2 |
react-server-dom-webpack npm | From 19.1.0 | 19.1.3 |
react-server-dom-webpack npm | From 19.1.0 | 19.1.3 |
react-server-dom-webpack npm | From 19.2.0 | 19.2.2 |
react-server-dom-webpack npm | From 19.2.0 | 19.2.2 |
Products include Facebook React, Vercel Next.js.
How do I fix CVE-2025-55183?
Upgrade react-server-dom-parcel to a fixed version for your release line: 19.0.2, 19.1.3 or 19.2.2.
Is CVE-2025-55183 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-55183 exists.
Public exploit code: 6 proofs of concept on GitHub.
Other vulnerabilities in Vercel Next.js
- CVE-2025-55182 Meta React Server Components Remote Code Execution
- CVE-2026-23864 React Server Components have multiple Denial of Service Vulnerabilities
- CVE-2025-55184 Denial of Service Vulnerability in React Server Components
- CVE-2025-67779 Denial of Service Vulnerability in React Server Components
- CVE-2018-6341 Cross-Site Scripting in react-dom
Sources
Also known as GHSA-925w-6v3x-g4j4.