CVE-2025-55183: 
React Server Components vulnerability analysis and mitigation

CVE-2025-55183 is a source code exposure (information leak) vulnerability in React Server Components affecting the packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. Specifically crafted HTTP requests sent to a vulnerable Server Function may cause the server to unsafely return the source code of any Server Function, but only when a Server Function explicitly or implicitly exposes a stringified argument. Affected React versions are 19.0.0–19.0.1, 19.1.0–19.1.2, and 19.2.0–19.2.1; Next.js versions 15.0.0–15.0.6, 15.1.0–15.1.10, 15.2.0–15.2.7, 15.3.0–15.3.7, 15.4.0–15.4.9, 15.5.0–15.5.8, 15.6.0 (various canaries), and 16.0.0–16.0.9 are also affected. Disclosed on December 11, 2025, it carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, react.dev Blog).

The root cause is improper handling of deserialized input in the React Server Components (RSC) flight protocol, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) and CWE-502 (Deserialization of Untrusted Data). When a Server Function receives a crafted HTTP request that causes a stringified argument to be reflected or processed in an unsafe manner, the RSC runtime may serialize and return the source code of the targeted Server Function — or potentially any Server Function — in the response. Exploitation requires the target application to have at least one Server Function that explicitly or implicitly exposes a stringified argument; applications not using React Server Components or a supporting framework/bundler are not affected. A proof-of-concept demonstrating the issue is referenced in the official React blog post, and public PoC repositories (e.g., github.com/Saturate/CVE-2025-55183, github.com/X-Cotang/CVE-2025-55183_POC) have been published (GitHub Advisory, react.dev Blog).

Successful exploitation allows an unauthenticated remote attacker to retrieve the server-side source code of Server Functions, exposing proprietary business logic, internal API endpoints, secrets embedded in code, database query structures, and other sensitive implementation details. This information disclosure can facilitate further attacks — such as identifying additional vulnerabilities, bypassing authentication logic, or enabling targeted exploitation of related systems — without directly compromising integrity or availability. The vulnerability's impact is limited to confidentiality and is conditional on the application's use of RSC with stringified argument exposure (GitHub Advisory, react.dev Blog, Feedly).

Public proof-of-concept code is available, including repositories on GitHub (CVE-2025-55183 by Saturate and X-Cotang) and a Nuclei template committed to the ProjectDiscovery nuclei-templates repository. The EPSS score is approximately 26.3% (96th percentile), indicating a high relative probability of exploitation within 30 days. The vulnerability is network-exploitable with no authentication or user interaction required, though exploitation is conditional on a specific application configuration. There is no confirmed evidence of widespread in-the-wild exploitation of CVE-2025-55183 specifically at time of disclosure; however, the broader React2Shell campaign (CVE-2025-55182) involving related RSC vulnerabilities has been attributed to nation-state threat actors including Chinese and Iranian groups, and the React ecosystem was under active scrutiny during this period (react.dev Blog, GitHub Advisory, Cloudflare Blog).

1. Reconnaissance: Identify web applications using React Server Components with react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack in versions 19.0.0–19.0.1, 19.1.0–19.1.2, or 19.2.0–19.2.1. Tools like Wappalyzer, HTTP response headers, or JavaScript bundle analysis can reveal RSC usage.
2. Identify Server Function endpoints: Locate RSC flight protocol endpoints (typically POST endpoints accepting RSC-encoded payloads) by analyzing network traffic or application source maps.
3. Craft malicious HTTP request: Construct a specially crafted HTTP POST request targeting a Server Function endpoint. The payload is designed to trigger the RSC runtime to deserialize input in a way that causes a stringified argument to be reflected, exploiting the improper deserialization logic (CWE-502).
4. Trigger source code disclosure: Send the crafted request to the vulnerable Server Function. If the function explicitly or implicitly exposes a stringified argument, the server response may include the serialized source code of the targeted Server Function or other Server Functions accessible to the runtime.
5. Extract and analyze source code: Parse the RSC flight protocol response to extract the leaked source code, then analyze it for hardcoded secrets, internal API routes, authentication logic, or other exploitable information to facilitate further attacks (react.dev Blog, GitHub Advisory).

• Network: Unusual or malformed HTTP POST requests to RSC flight protocol endpoints (e.g., endpoints accepting text/x-component or RSC-encoded content types) from unexpected source IPs; responses containing JavaScript source code or function definitions in RSC flight format.
• Logs: Server access logs showing POST requests to Server Function endpoints with atypical payloads or content types; error logs indicating unexpected serialization or deserialization activity in the RSC runtime; responses with abnormally large payloads containing source-like content.
• File System: No direct file system artifacts expected for this information disclosure vulnerability; however, presence of scanning tools or PoC scripts (e.g., react-rsc-vuln-scanner npm package, files referencing CVE-2025-55183) on attacker-controlled infrastructure may indicate reconnaissance activity.
• Process: Unexpected spikes in server CPU or memory usage associated with RSC deserialization processing, potentially indicating automated scanning or exploitation attempts (react.dev Blog, Cloudflare Blog).

Upgrade immediately to the patched versions: React 19.0.2, 19.1.3, or 19.2.2 for the affected packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack). For Next.js users, upgrade to 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 16.0.10, or later stable releases. Applications that do not use React Server Components or a framework/bundler supporting RSC are not affected and require no action. As a temporary measure, review all Server Functions to ensure no function explicitly or implicitly exposes stringified arguments to untrusted input, and consider restricting access to RSC flight endpoints at the network or WAF layer (GitHub Advisory, react.dev Blog, Vercel Changelog).

Meta/React published an official blog post and Facebook security advisory on December 11, 2025, urging immediate upgrades and providing detailed remediation guidance (react.dev Blog, Facebook Advisory). Vercel, Netlify, and WordPress VIP each issued their own security advisories and changelogs, with Vercel noting the vulnerability in the context of the broader RSC security update (Vercel Changelog). The vulnerability received significant coverage from security outlets including The Hacker News, The Register, Cybersecurity Dive, Cloudflare, Akamai, and Socket.dev, often discussed alongside the related CVE-2025-55184 (DoS) and the higher-severity CVE-2025-55182 (React2Shell RCE). Community discussion on Reddit, Hacker News, and Bluesky was active, with developers expressing concern about the pace of React security disclosures and the complexity of RSC security models (Cloudflare Blog, The Register).