CVE-2025-55183

A flaw was found in React Server Components (RSC). This vulnerability allows an information leak, where a specifically crafted HTTP (Hypertext Transfer Protocol) request to a vulnerable Server Function can unsafely return its source code. Exploitation requires a Server Function that explicitly or implicitly exposes a stringified argument. A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.

No Red Hat software includes the directly affected React Server Components packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack). However, the reference implementation of React Server Components is used by other projects such as Next.js. The packages listed here include Next.js as a dependency, but our analysis indicates that they are not affected by the vulnerability as they do not use the App Router functionality that exposes endpoints serving the vulnerable protocol that can return the compiled source code of Server Functions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.