# CVE-2025-55183: An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.

Source: https://junglewise.ai/threats/cve-2025-55183-react-server-components-source-code-exposure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-55183 · Severity: medium · CVSS 5.3 · Published 2025-12-11

React Server Components are a framework feature that enables server-side rendering of React applications. A source code exposure vulnerability in the webpack, Parcel, and Turbopack integration libraries allows attackers to access sensitive application source code over the network without authentication, potentially revealing business logic, API keys, or other proprietary information.

Technologies: [react-server-dom-parcel (npm)](https://junglewise.ai/threats/technologies/react-server-dom-parcel), [react-server-dom-turbopack (npm)](https://junglewise.ai/threats/technologies/react-server-dom-turbopack), [react-server-dom-webpack (npm)](https://junglewise.ai/threats/technologies/react-server-dom-webpack). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-55183 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-55183 being exploited in the wild.

**How severe is CVE-2025-55183?** Medium severity, with a CVSS score of 5.3, published 11 December 2025.

**Which products and versions are affected?** react-server-dom-parcel (npm) SEMVER:introduced=19.0.0,fixed=19.0.2; react-server-dom-turbopack (npm) SEMVER:introduced=19.0.0,fixed=19.0.2; react-server-dom-webpack (npm) SEMVER:introduced=19.0.0,fixed=19.0.2.

**Is there a fix for CVE-2025-55183?** Yes. react-server-dom-parcel (npm): upgrade to 19.0.2 or later; react-server-dom-turbopack (npm): upgrade to 19.0.2 or later; react-server-dom-webpack (npm): upgrade to 19.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-55183 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-55183?** Check whether you run react-server-dom-parcel (npm), react-server-dom-turbopack (npm) or react-server-dom-webpack (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- react-server-dom-parcel (npm): upgrade to 19.0.2 or later

  ```sh
  npm install react-server-dom-parcel@19.0.2
  ```

- react-server-dom-turbopack (npm): upgrade to 19.0.2 or later

  ```sh
  npm install react-server-dom-turbopack@19.0.2
  ```

- react-server-dom-webpack (npm): upgrade to 19.0.2 or later

  ```sh
  npm install react-server-dom-webpack@19.0.2
  ```


## Technical details

This is a source code exposure vulnerability (CWE-497, CWE-502) in three React Server Components integration libraries: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. The vulnerability is present in versions 19.0.0–19.0.1, 19.1.0–19.1.2, and 19.2.0–19.2.1. The flaw allows unauthenticated network attackers to retrieve sensitive application source code. Patches are available in versions 19.0.2, 19.1.3, and 19.2.2. Applications that do not use React Server Components or do not use a compatible framework/bundler are unaffected.

## Affected products

- Meta react-server-dom-webpack 19.0.0–19.2.1
- Meta react-server-dom-parcel 19.0.0–19.2.1
- Meta react-server-dom-turbopack 19.0.0–19.2.1

## Identifiers

- CVE-2025-55183
- GHSA-925w-6v3x-g4j4

## Timeline

- 2025-12-11: disclosed
- 2025-12-11: patched: Patches released in versions 19.0.2, 19.1.3, and 19.2.2

## References

- [https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4](https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4)

## Related threats

- [React Server Components remote code execution via deserialization](https://junglewise.ai/threats/cve-2026-126187-react-unauthenticated-remote-code-execution-in-react-server)
- [Meta React denial of service in Server Functions](https://junglewise.ai/threats/cve-2026-44907-meta-react-denial-of-service-in-server-functions)
- [Facebook React Denial of Service in React Server Components](https://junglewise.ai/threats/cve-2026-23870-facebook-react-denial-of-service-in-react-server-components)
- [Meta React Server Components denial of service in Server Functions](https://junglewise.ai/threats/cve-2026-23869-meta-react-server-components-denial-of-service-in-server)
- [Meta React Server Components denial of service in Server Function endpoints](https://junglewise.ai/threats/cve-2026-23864-meta-react-server-components-denial-of-service-in-server-function)