Executive brief
React Server Components are a framework feature that enables server-side rendering of React applications. A source code exposure vulnerability in the webpack, Parcel, and Turbopack integration libraries allows attackers to access sensitive application source code over the network without authentication, potentially revealing business logic, API keys, or other proprietary information.
Technical details
This is a source code exposure vulnerability (CWE-497, CWE-502) in three React Server Components integration libraries: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. The vulnerability is present in versions 19.0.0–19.0.1, 19.1.0–19.1.2, and 19.2.0–19.2.1. The flaw allows unauthenticated network attackers to retrieve sensitive application source code. Patches are available in versions 19.0.2, 19.1.3, and 19.2.2. Applications that do not use React Server Components or do not use a compatible framework/bundler are unaffected.
Affected products
- Meta react-server-dom-webpack 19.0.0–19.2.1
- Meta react-server-dom-parcel 19.0.0–19.2.1
- Meta react-server-dom-turbopack 19.0.0–19.2.1
Timeline
- 2025-12-11: disclosed
- 2025-12-11: patched: Patches released in versions 19.0.2, 19.1.3, and 19.2.2