New React RSC Vulnerabilities Enable DoS and Source Code Exposure
Summary: The React team released fixes for two new types of flaws in React Server Components that could enable denial-of-service or source code exposure, found by the security community while attempting to exploit patches for CVE-2025-55182, a critical RSC bug with a CVSS score of 10.0 that has been weaponized in the wild. Exploitation of CVE-2025-55183 requires a Server Function that explicitly or implicitly exposes an argument converted into a string format, and researchers RyotaK and Shinsaku Nomura reported the two DoS bugs to the Meta Bug Bounty program while Andrew MacPherson was credited with the information leak flaw.
What you should know: The variant flaws surfaced only because researchers probed adjacent code paths after a CVSS 10.0 RSC bug was already exploited in the wild, and users are advised to move to versions 19.0.3, 19.1.4, and 19.2.3 - so any team still running older react-server-dom-parcel, -turbopack, or -webpack builds is exposed on two fronts at once.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-55182CVE-2025-55183
- Related
- CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 05, 2025