Deserialization of untrusted data in Meta react-server-dom-webpack
Priority HIGH 66CWE-497Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Code execution
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-497 and CWE-502.
Summary
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.64233 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed react-server-dom-parcel (npm): 19.0.2, 19.1.3, 19.2.2react-server-dom-turbopack (npm): 19.0.2, 19.1.3, 19.2.2+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Meta | react-server-dom-webpack | 19.0.0 – 19.0.1; 19.1.0 – 19.1.2; 19.2.0 – 19.2.1 | — | No fix listed | CNA |
| Meta | react-server-dom-turbopack | 19.0.0 – 19.0.1; 19.1.0 – 19.1.2; 19.2.0 – 19.2.1 | — | No fix listed | CNA |
| Meta | react-server-dom-parcel | 19.0.0 – 19.0.1; 19.1.0 – 19.1.2; 19.2.0 – 19.2.1 | — | No fix listed | CNA |
| — | react-server-dom-parcel (npm) | 19.0.0 to before 19.0.2 | 19.0.2 | Patch available | GHSA-925w-6v3x-g4j4 |
| — | react-server-dom-turbopack (npm) | 19.0.0 to before 19.0.2 | 19.0.2 | Patch available | GHSA-925w-6v3x-g4j4 |
| — | react-server-dom-webpack (npm) | 19.0.0 to before 19.0.2 | 19.0.2 | Patch available | GHSA-925w-6v3x-g4j4 |
| — | react-server-dom-parcel (npm) | 19.1.0 to before 19.1.3 | 19.1.3 | Patch available | GHSA-925w-6v3x-g4j4 |
| — | react-server-dom-parcel (npm) | 19.2.0 to before 19.2.2 | 19.2.2 | Patch available | GHSA-925w-6v3x-g4j4 |
| — | react-server-dom-turbopack (npm) | 19.1.0 to before 19.1.3 | 19.1.3 | Patch available | GHSA-925w-6v3x-g4j4 |
| — | react-server-dom-turbopack (npm) | 19.2.0 to before 19.2.2 | 19.2.2 | Patch available | GHSA-925w-6v3x-g4j4 |
| — | react-server-dom-webpack (npm) | 19.1.0 to before 19.1.3 | 19.1.3 | Patch available | GHSA-925w-6v3x-g4j4 |
| — | react-server-dom-webpack (npm) | 19.2.0 to before 19.2.2 | 19.2.2 | Patch available | GHSA-925w-6v3x-g4j4 |
- react-server-dom-webpack VendorMeta Affected 19.0.0 – 19.0.1; 19.1.0 – 19.1.2; 19.2.0 – 19.2.1 Fixed in — No fix listed CNA
- react-server-dom-turbopack VendorMeta Affected 19.0.0 – 19.0.1; 19.1.0 – 19.1.2; 19.2.0 – 19.2.1 Fixed in — No fix listed CNA
- react-server-dom-parcel VendorMeta Affected 19.0.0 – 19.0.1; 19.1.0 – 19.1.2; 19.2.0 – 19.2.1 Fixed in — No fix listed CNA
- react-server-dom-parcel (npm) Vendor— Affected 19.0.0 to before 19.0.2 Fixed in 19.0.2 Patch available GHSA-925w-6v3x-g4j4
- react-server-dom-turbopack (npm) Vendor— Affected 19.0.0 to before 19.0.2 Fixed in 19.0.2 Patch available GHSA-925w-6v3x-g4j4
- react-server-dom-webpack (npm) Vendor— Affected 19.0.0 to before 19.0.2 Fixed in 19.0.2 Patch available GHSA-925w-6v3x-g4j4
- react-server-dom-parcel (npm) Vendor— Affected 19.1.0 to before 19.1.3 Fixed in 19.1.3 Patch available GHSA-925w-6v3x-g4j4
- react-server-dom-parcel (npm) Vendor— Affected 19.2.0 to before 19.2.2 Fixed in 19.2.2 Patch available GHSA-925w-6v3x-g4j4
- react-server-dom-turbopack (npm) Vendor— Affected 19.1.0 to before 19.1.3 Fixed in 19.1.3 Patch available GHSA-925w-6v3x-g4j4
- react-server-dom-turbopack (npm) Vendor— Affected 19.2.0 to before 19.2.2 Fixed in 19.2.2 Patch available GHSA-925w-6v3x-g4j4
- react-server-dom-webpack (npm) Vendor— Affected 19.1.0 to before 19.1.3 Fixed in 19.1.3 Patch available GHSA-925w-6v3x-g4j4
- react-server-dom-webpack (npm) Vendor— Affected 19.2.0 to before 19.2.2 Fixed in 19.2.2 Patch available GHSA-925w-6v3x-g4j4
CPE configurations NVD · 83
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* | 15.0.0 to before 15.0.7; 15.1.0 to before 15.1.11; 15.2.0 to before 15.2.8; 15.3.0 to before 15.3.8; 15.4.0 to before 15.4.10; 15.5.0 to before 15.5.9; 16.0.0 to before 16.0.10 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:* | 15.6.0 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:* | 15.6.0 canary0 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:* | 15.6.0 canary1 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:* | 15.6.0 canary10 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:* | 15.6.0 canary11 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:* | 15.6.0 canary12 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:* | 15.6.0 canary13 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:* | 15.6.0 canary14 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:* | 15.6.0 canary15 | Vulnerable | vercel |
- cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions 15.0.0 to before 15.0.7; 15.1.0 to before 15.1.11; 15.2.0 to before 15.2.8; 15.3.0 to before 15.3.8; 15.4.0 to before 15.4.10; 15.5.0 to before 15.5.9; 16.0.0 to before 16.0.10 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:* Versions 15.6.0 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:* Versions 15.6.0 canary0 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:* Versions 15.6.0 canary1 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:* Versions 15.6.0 canary10 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:* Versions 15.6.0 canary11 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:* Versions 15.6.0 canary12 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:* Versions 15.6.0 canary13 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:* Versions 15.6.0 canary14 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:* Versions 15.6.0 canary15 Vulnerable ·vercel
Show 73 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:* | 15.6.0 canary16 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:* | 15.6.0 canary17 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:* | 15.6.0 canary18 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:* | 15.6.0 canary19 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:* | 15.6.0 canary2 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:* | 15.6.0 canary20 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:* | 15.6.0 canary21 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:* | 15.6.0 canary22 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:* | 15.6.0 canary23 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:* | 15.6.0 canary24 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:* | 15.6.0 canary25 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:* | 15.6.0 canary26 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:* | 15.6.0 canary27 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:* | 15.6.0 canary28 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:* | 15.6.0 canary29 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:* | 15.6.0 canary3 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:* | 15.6.0 canary30 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:* | 15.6.0 canary31 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:* | 15.6.0 canary32 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:* | 15.6.0 canary33 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:* | 15.6.0 canary34 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:* | 15.6.0 canary35 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:* | 15.6.0 canary36 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:* | 15.6.0 canary37 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:* | 15.6.0 canary38 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:* | 15.6.0 canary39 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:* | 15.6.0 canary4 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:* | 15.6.0 canary40 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:* | 15.6.0 canary41 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:* | 15.6.0 canary42 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:* | 15.6.0 canary43 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:* | 15.6.0 canary44 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:* | 15.6.0 canary45 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:* | 15.6.0 canary46 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:* | 15.6.0 canary47 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:* | 15.6.0 canary48 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:* | 15.6.0 canary49 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:* | 15.6.0 canary5 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:* | 15.6.0 canary50 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:* | 15.6.0 canary51 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:* | 15.6.0 canary52 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:* | 15.6.0 canary53 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:* | 15.6.0 canary54 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:* | 15.6.0 canary55 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:* | 15.6.0 canary56 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:* | 15.6.0 canary57 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:* | 15.6.0 canary58 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:* | 15.6.0 canary59 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:* | 15.6.0 canary6 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:* | 15.6.0 canary7 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:* | 15.6.0 canary8 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:* | 15.6.0 canary9 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:-:*:*:*:node.js:*:* | 16.1.0 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary0:*:*:*:node.js:*:* | 16.1.0 canary0 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary1:*:*:*:node.js:*:* | 16.1.0 canary1 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary10:*:*:*:node.js:*:* | 16.1.0 canary10 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary11:*:*:*:node.js:*:* | 16.1.0 canary11 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary12:*:*:*:node.js:*:* | 16.1.0 canary12 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary13:*:*:*:node.js:*:* | 16.1.0 canary13 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary14:*:*:*:node.js:*:* | 16.1.0 canary14 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary15:*:*:*:node.js:*:* | 16.1.0 canary15 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary16:*:*:*:node.js:*:* | 16.1.0 canary16 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary17:*:*:*:node.js:*:* | 16.1.0 canary17 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary18:*:*:*:node.js:*:* | 16.1.0 canary18 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary2:*:*:*:node.js:*:* | 16.1.0 canary2 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary3:*:*:*:node.js:*:* | 16.1.0 canary3 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary4:*:*:*:node.js:*:* | 16.1.0 canary4 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary5:*:*:*:node.js:*:* | 16.1.0 canary5 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary6:*:*:*:node.js:*:* | 16.1.0 canary6 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary7:*:*:*:node.js:*:* | 16.1.0 canary7 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary8:*:*:*:node.js:*:* | 16.1.0 canary8 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary9:*:*:*:node.js:*:* | 16.1.0 canary9 | Vulnerable | vercel |
| cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:* | 19.0.0 to before 19.0.2; 19.1.0 to before 19.1.3; 19.2.0 to before 19.2.2 | Vulnerable | Meta |
- cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:* Versions 15.6.0 canary16 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:* Versions 15.6.0 canary17 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:* Versions 15.6.0 canary18 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:* Versions 15.6.0 canary19 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:* Versions 15.6.0 canary2 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:* Versions 15.6.0 canary20 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:* Versions 15.6.0 canary21 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:* Versions 15.6.0 canary22 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:* Versions 15.6.0 canary23 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:* Versions 15.6.0 canary24 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:* Versions 15.6.0 canary25 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:* Versions 15.6.0 canary26 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:* Versions 15.6.0 canary27 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:* Versions 15.6.0 canary28 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:* Versions 15.6.0 canary29 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:* Versions 15.6.0 canary3 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:* Versions 15.6.0 canary30 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:* Versions 15.6.0 canary31 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:* Versions 15.6.0 canary32 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:* Versions 15.6.0 canary33 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:* Versions 15.6.0 canary34 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:* Versions 15.6.0 canary35 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:* Versions 15.6.0 canary36 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:* Versions 15.6.0 canary37 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:* Versions 15.6.0 canary38 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:* Versions 15.6.0 canary39 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:* Versions 15.6.0 canary4 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:* Versions 15.6.0 canary40 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:* Versions 15.6.0 canary41 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:* Versions 15.6.0 canary42 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:* Versions 15.6.0 canary43 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:* Versions 15.6.0 canary44 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:* Versions 15.6.0 canary45 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:* Versions 15.6.0 canary46 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:* Versions 15.6.0 canary47 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:* Versions 15.6.0 canary48 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:* Versions 15.6.0 canary49 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:* Versions 15.6.0 canary5 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:* Versions 15.6.0 canary50 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:* Versions 15.6.0 canary51 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:* Versions 15.6.0 canary52 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:* Versions 15.6.0 canary53 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:* Versions 15.6.0 canary54 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:* Versions 15.6.0 canary55 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:* Versions 15.6.0 canary56 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:* Versions 15.6.0 canary57 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:* Versions 15.6.0 canary58 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:* Versions 15.6.0 canary59 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:* Versions 15.6.0 canary6 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:* Versions 15.6.0 canary7 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:* Versions 15.6.0 canary8 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:* Versions 15.6.0 canary9 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:-:*:*:*:node.js:*:* Versions 16.1.0 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary0:*:*:*:node.js:*:* Versions 16.1.0 canary0 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary1:*:*:*:node.js:*:* Versions 16.1.0 canary1 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary10:*:*:*:node.js:*:* Versions 16.1.0 canary10 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary11:*:*:*:node.js:*:* Versions 16.1.0 canary11 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary12:*:*:*:node.js:*:* Versions 16.1.0 canary12 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary13:*:*:*:node.js:*:* Versions 16.1.0 canary13 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary14:*:*:*:node.js:*:* Versions 16.1.0 canary14 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary15:*:*:*:node.js:*:* Versions 16.1.0 canary15 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary16:*:*:*:node.js:*:* Versions 16.1.0 canary16 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary17:*:*:*:node.js:*:* Versions 16.1.0 canary17 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary18:*:*:*:node.js:*:* Versions 16.1.0 canary18 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary2:*:*:*:node.js:*:* Versions 16.1.0 canary2 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary3:*:*:*:node.js:*:* Versions 16.1.0 canary3 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary4:*:*:*:node.js:*:* Versions 16.1.0 canary4 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary5:*:*:*:node.js:*:* Versions 16.1.0 canary5 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary6:*:*:*:node.js:*:* Versions 16.1.0 canary6 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary7:*:*:*:node.js:*:* Versions 16.1.0 canary7 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary8:*:*:*:node.js:*:* Versions 16.1.0 canary8 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary9:*:*:*:node.js:*:* Versions 16.1.0 canary9 Vulnerable ·vercel
- cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:* Versions 19.0.0 to before 19.0.2; 19.1.0 to before 19.1.3; 19.2.0 to before 19.2.2 Vulnerable ·Meta
Remediation
- Fix · GHSA-925w-6v3x-g4j4 react-server-dom-parcel (npm) Fixed in 19.0.2 Advisory →
- Fix · GHSA-925w-6v3x-g4j4 react-server-dom-turbopack (npm) Fixed in 19.0.2 Advisory →
- Fix · GHSA-925w-6v3x-g4j4 react-server-dom-webpack (npm) Fixed in 19.0.2 Advisory →
- Fix · GHSA-925w-6v3x-g4j4 react-server-dom-parcel (npm) Fixed in 19.1.3 Advisory →
- Fix · GHSA-925w-6v3x-g4j4 react-server-dom-parcel (npm) Fixed in 19.2.2 Advisory →
- Fix · GHSA-925w-6v3x-g4j4 react-server-dom-turbopack (npm) Fixed in 19.1.3 Advisory →
- Fix · GHSA-925w-6v3x-g4j4 react-server-dom-turbopack (npm) Fixed in 19.2.2 Advisory →
- Fix · GHSA-925w-6v3x-g4j4 react-server-dom-webpack (npm) Fixed in 19.1.3 Advisory →
- Fix · GHSA-925w-6v3x-g4j4 react-server-dom-webpack (npm) Fixed in 19.2.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 8 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Trusted Artifact Signer
- streams for Apache Kafka 2
- streams for Apache Kafka 3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-55183
- 2026-10-03 Alias added: GHSA-925w-6v3x-g4j4
References
Advisory 2
More Meta React vulnerabilities
- TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
- TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
- TI-2025-41449 Uncontrolled resource consumption in Meta react-server-dom-parcel CVSS 3.1HIGH 7.5
- TI-2026-19225 Uncontrolled resource consumption in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
- TI-2018-04665 Cross-site scripting in Meta react-dom CVSS 3.1MEDIUM 6.1
Sources
- CVE-2025-55183 · CVE Program
- CVE-2025-55183 · NVD
- FIRST EPSS
- GHSA-925w-6v3x-g4j4 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-55183 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences