CVE-2025-55183

CVE-2025-55183 is an information-disclosure flaw in specific configurations of React Server Components in versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, affecting the packages react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack. A specially crafted HTTP request sent to a vulnerable Server Function can cause it to unsafely return the source code of any Server Function, but only when the application has a Server Function that explicitly or implicitly exposes a stringified argument. An attacker gains unauthenticated read access to server-side application source code (CVSS 5.3, network-exploitable with no privileges or user interaction, confidentiality-only impact), which is valuable reconnaissance that can enable follow-on attacks alongside the related React RSC denial-of-service flaws. Affected are any applications running the listed React 19.x RSC packages, most prominently Next.js deployments that use React Server Components and Server Functions. A vendor advisory with public exploit guidance was published on December 11, 2025, reporting of 'React2Shell' fallout indicates public exploits are circulating, and EPSS assigns a 64.2% probability of exploitation within 30 days (99th percentile), though the flaw is not yet in CISA KEV.

What to do: Upgrade react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel to patched releases newer than the affected 19.0.0-19.2.1 versions, and update Next.js's bundled React accordingly, following the React team's December 11, 2025 advisory. Audit your application for Server Functions that explicitly or implicitly expose stringified arguments, since exploitation requires such a function to exist. Until patched, restrict and monitor external access to Server Function endpoints; no CISA KEV deadline applies yet.