CVE-2025-55183
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
More exploitable than 99% of all CVEs · Top 1%
of the sites UNPWNED scans run Next.js, the technology this CVE affects. Version determines exposure, so scan yours to know for sure.Aggregate across 730 scanned sites. No site is identified.
Is your site exposed to this?
Run a free scan. UNPWNED fingerprints your stack and flags this CVE class if the affected technology is detected.
- Published
- 2025-12-11
- Last modified
- 2026-10-07
- Affected
- Next.js, React
Related exploited CVEs in Next.js
Data from the National Vulnerability Database (NVD), CISA KEV, and FIRST.org EPSS. This product uses the NVD API but is not endorsed or certified by the NVD. EPSS is a probability estimate, not a guarantee of exploitation.