GHSA-cpqf-f22c-r95x Vite Plugin React has a Denial of Service Vulnerability in React Server Components
A denial of service vulnerability in the vendored React Server Components library allows attackers to disrupt services using the Vite React plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-cpqf-f22c-r95x?
GHSA-cpqf-f22c-r95x is a denial of service vulnerability in @vitejs/plugin-rsc, published on 12 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.3. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-7gmr-mq3h-m5h9
Patches
Upgrade immediately to @vitejs/[email protected] or later.
Which versions are affected by GHSA-cpqf-f22c-r95x?
2 open source packages ship an affected version, including @vitejs/plugin-rsc.
| Package | Affected | Fixed in |
|---|---|---|
@vitejs/plugin-rsc npm | All versions | 0.5.7 |
@vitejs/plugin-rsc npm | All versions | 0.5.7 |
How do I fix GHSA-cpqf-f22c-r95x?
Upgrade @vitejs/plugin-rsc to 0.5.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-cpqf-f22c-r95x being exploited?
There is no known exploitation of GHSA-cpqf-f22c-r95x in the wild and no public exploit code.