GHSA-fmh4-wr37-44fp React Server Components are Vulnerable to RCE
Unauthenticated attackers can execute arbitrary code via deserialization in React Server Components plugins, requiring immediate upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-fmh4-wr37-44fp?
GHSA-fmh4-wr37-44fp is an unsafe deserialization vulnerability in @vitejs/plugin-rsc, published on 3 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained an unauthenticated remote code execution vulnerability in versions prior to 19.0.1, 19.1.2, and 19.2.1. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
Impact
Applications using affected versions of @vitejs/plugin-rsc are vulnerable to unauthenticated remote code execution through deserialization of untrusted data. An attacker can execute arbitrary code remotely without authentication, affecting confidentiality, integrity, and availability.
Recommendations
Upgrade immediately to @vitejs/[email protected] or later.
Workarounds
Applications not using server-side React or React Server Components are unaffected.
Which versions are affected by GHSA-fmh4-wr37-44fp?
2 open source packages ship an affected version, including @vitejs/plugin-rsc.
| Package | Affected | Fixed in |
|---|---|---|
@vitejs/plugin-rsc npm | All versions | 0.5.3 |
@vitejs/plugin-rsc npm | All versions | 0.5.3 |
How do I fix GHSA-fmh4-wr37-44fp?
Upgrade @vitejs/plugin-rsc to 0.5.3 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is GHSA-fmh4-wr37-44fp being exploited?
There is no known exploitation of GHSA-fmh4-wr37-44fp in the wild and no public exploit code.