PT-2025-50722 · Unknown+1 · React-Server-Dom-Turbopack+3

Published 2025-12-11 · Updated 2026-02-26 · CVE-2025-55183

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions React versions 19.0.0 through 19.2.1 react-server-dom-parcel versions 19.0.0 through 19.2.1 react-server-dom-turbopack versions 19.0.0 through 19.2.1 react-server-dom-webpack versions 19.0.0 through 19.2.1

Description An information leak issue exists in React Server Components. A crafted HTTP request to a vulnerable Server Function can expose the source code of that function. This requires the Server Function to expose a stringified argument. The issue affects applications using React Server Components, potentially impacting a large number of deployments. The vulnerability could lead to the disclosure of business logic and potentially sensitive information.

Recommendations Update to a newer version of React that contains a fix for this vulnerability.

Fix

Related Identifiers

CVE-2025-55183

GHSA-925W-6V3X-G4J4

Affected Products

React

React-Server-Dom-Parcel

React-Server-Dom-Turbopack

React-Server-Dom-Webpack

References · 85

• https://facebook.com/security/advisories/cve-2025-55183 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55183 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55183 · Security Note
• https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components · Vendor Advisory
• https://twitter.com/ServerComponent/status/1999314158572220785 · Twitter Post
• https://t.me/true_secator/7723 · Telegram Post
• https://twitter.com/baga18650/status/1999619145848287269 · Twitter Post
• https://reddit.com/r/ClaudeAI/comments/1plbo0u/first_time_with_claude_code_web_2_prompts_and_4 · Reddit Post
• https://twitter.com/grok/status/1999695930761605480 · Twitter Post
• https://twitter.com/grok/status/1999909325775462433 · Twitter Post
• https://twitter.com/Parth_pandya1/status/1999731257744458100 · Twitter Post
• https://twitter.com/Cloudforce_One/status/1999219500382847471 · Twitter Post
• https://reddit.com/r/u_WardenShield/comments/1ptf5kf/indepth_analysis_of_react_server_components · Reddit Post
• https://twitter.com/becodewala/status/2000444041608237288 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1pvb52w/top_10_trending_cves_25122025 · Reddit Post