CVE-2025-55183: Source Code Exposure Vulnerability in React Server Components
Summary
CVE-2025-55183: Source Code Exposure Vulnerability in React Server Components. Affects react-server-dom-parcel across 3 version ranges.
>= 19.0.0, < 19.0.2
>= 19.1.0, < 19.1.3
>= 19.2.0, < 19.2.2
Fixed in 19.0.2, 19.1.3 or 19.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React Server Components is a powerful feature of the React library that allows developers to build modern web applications with improved performance and user experience. It enables server-side rendering of components, which can lead to faster load times and better SEO. However, certain versions of React Server Components have been found to be vulnerable to a source code exposure issue, which could potentially allow unauthorized access to sensitive source code.
Vulnerability Detail
The vulnerability arises from improper handling of server-rendered components in React Server Components, specifically in versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 of the packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. This flaw can lead to unauthorized exposure of the source code, which could be exploited by malicious actors to gain insights into the application's logic and potentially compromise its security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 19.0.0, < 19.0.219.0.2npm install react-server-dom-parcel@19.0.2 -
>= 19.1.0, < 19.1.319.1.3npm install react-server-dom-parcel@19.1.3 -
>= 19.2.0, < 19.2.219.2.2npm install react-server-dom-parcel@19.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If your application does not utilize a server or does not employ a framework, bundler, or bundler plugin that supports React Server Components, you are not affected by this vulnerability. However, if you are unable to update immediately, consider reviewing your server-side code for any potential exposure points and restrict access to sensitive information.
Conclusion
In summary, the source code exposure vulnerability in React Server Components poses a significant risk to applications using affected versions of the packages. It is crucial to update to the patched versions promptly to mitigate this risk. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your applications effectively.
See every vulnerability recorded for react-server-dom-parcel →
FAQ
The vulnerability is a source code exposure issue that can allow unauthorized access to sensitive source code in specific versions of React Server Components.
The affected versions include 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By simply using your package-lock.json file, you can check if your application is affected without any installation. Visit the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
If immediate updates are not possible, review your server-side code for potential exposure points and restrict access to sensitive information until you can apply the necessary patches.
Related vulnerabilities
Recent vulnerabilities recorded for react-server-dom-parcel.
