Vulnerabilitycritical
New React RSC Vulnerabilities Enable DoS and Source Code Exposure
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) | 10.0 | 100% | KEVRansomwarePoC ×13 | KEV |
| CVE-2025-55183 | Unauthenticated source code exposure in React Server Components 19.x (incl. Next.js) | 5.3 | 64% | PoC | |
| CVE-2025-55184 | Unauthenticated Denial-of-Service in React Server Components 19.x and Next.js | 7.5 | 67% | ||
| CVE-2025-67779 | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case | 7.5 | 20% |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Dec 12, 2025 Software Security / Vulnerability The React team has released fixes for two new types of flaws in React Server Components (RSC) that, if successfully exploited, could result in denial-of-service (DoS) or source code exposure. The team said the issues were found by the security community while attempting to exploit the patches released for CVE-2025-55182 (CVSS score: 10.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.