CVE-2025-55183

Name of the Vulnerable Software and Affected Versions React versions 19.0.0 through 19.2.1 react-server-dom-parcel versions 19.0.0 through 19.2.1 react-server-dom-turbopack versions 19.0.0 through 19.2.1 react-server-dom-webpack versions 19.0.0 through 19.2.1

Description An information leak issue exists in React Server Components. A crafted HTTP request to a vulnerable Server Function can expose the source code of that function. Exploitation requires a Server Function that exposes a stringified argument. The issue may affect applications even without Server Functions. The vulnerability could potentially reveal business logic and assumptions.

Recommendations Update to a newer version of React to address this vulnerability.