CVE-2025-55183
📋 TL;DR
An information leak vulnerability in React Server Components allows attackers to retrieve source code of Server Functions via crafted HTTP requests. This affects React Server Components versions 19.0.0 through 19.2.1 when Server Functions expose stringified arguments. Applications using react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack packages are vulnerable.
💻 Affected Systems
- react-server-dom-parcel
- react-server-dom-turbopack
- react-server-dom-webpack
📦 What is this software?
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
React by Facebook
React by Facebook
React by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Complete exposure of server-side application source code including business logic, API keys, and sensitive configuration, potentially leading to further attacks.
Likely Case
Partial source code disclosure revealing implementation details that could aid in discovering other vulnerabilities.
If Mitigated
Limited exposure of non-sensitive code snippets with proper input validation and function isolation.
🎯 Exploit Status
Exploitation requires identifying vulnerable Server Functions but doesn't require authentication. Attack pattern involves crafting specific HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 19.2.2 or later
Vendor Advisory: https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
Restart Required: Yes
Instructions:
1. Update React Server Components to version 19.2.2 or later
2. Update package.json dependencies to use patched versions
3. Run npm update or yarn update
4. Restart the application server
5. Verify no breaking changes in your implementation
🔧 Temporary Workarounds
Input Validation for Server Functions
allAdd strict input validation to all Server Functions to prevent stringified argument exposure
Disable Vulnerable Server Functions
allTemporarily disable Server Functions that accept stringified arguments until patched
🧯 If You Can't Patch
- Implement WAF rules to block suspicious HTTP requests targeting Server Functions
- Isolate React Server Components behind authentication or API gateways
🔍 How to Verify
Check if Vulnerable:
Check package.json for affected React Server Components versions and review Server Functions for stringified argument exposureCheck Version:
npm list react-server-dom-parcel react-server-dom-turbopack react-server-dom-webpackVerify Fix Applied:
Verify installed React Server Components version is 19.2.2 or later and test Server Functions with crafted requests📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to Server Functions with crafted parameters
- Increased error rates in Server Function responses
Network Indicators:
- HTTP requests with suspicious string patterns targeting Server Function endpoints
SIEM Query:
source="web_server" AND (uri="*server-function*" OR uri="*rsc*") AND (param="*toString*" OR param="*stringify*")