React Server Components remote code execution via deserialization

Severity: low · CVSS 3.1 · Published 2025-12-03

React Server Components, which power server-side rendering in modern web frameworks like Next.js, contain a critical vulnerability allowing unauthenticated attackers to execute arbitrary code on affected servers. The flaw exists in how React deserializes untrusted data from clients, enabling full compromise of application confidentiality, integrity, and availability without any authentication or user interaction required.

Technologies: @vitejs/plugin-rsc (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Low severity, with a CVSS score of 3.1, published 3 December 2025.
Which products and versions are affected?
@vitejs/plugin-rsc (npm) SEMVER:introduced=0,fixed=0.5.3; Vercel Next.js 15.x, 16.x, 14.3.0-canary.77+; fixed in 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+.
Is there a fix for This vulnerability?
Yes. @vitejs/plugin-rsc (npm): upgrade to 0.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network.
Am I affected?
Check whether you run @vitejs/plugin-rsc (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @vitejs/plugin-rsc (npm): upgrade to 0.5.3 or later
    npm install @vitejs/plugin-rsc@0.5.3

Technical details

The vulnerability is a deserialization attack (CWE-502) in React's server-side rendering packages (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack). These packages fail to properly validate and sanitize untrusted client-supplied data before deserializing it, allowing attackers to craft malicious serialized payloads that execute arbitrary code on the server. The flaw affects versions 19.0.0, 19.1.0–19.1.1, and 19.2.0; no authentication is required and the attack is network-reachable. Patches were released in React versions 19.0.1, 19.1.2, and 19.2.1. Downstream frameworks like Next.js (versions 15.x, 16.x, and canary 14.3.0-canary.77+) are also affected when using React Server Components, with corresponding patches available.

Affected products

  • Meta react-server-dom-webpack 19.0.0, 19.1.0–19.1.1, 19.2.0; fixed in 19.0.1, 19.1.2, 19.2.1
  • Meta react-server-dom-parcel 19.0.0, 19.1.0–19.1.1, 19.2.0; fixed in 19.0.1, 19.1.2, 19.2.1
  • Meta react-server-dom-turbopack 19.0.0, 19.1.0–19.1.1, 19.2.0; fixed in 19.0.1, 19.1.2, 19.2.1
  • Vercel Next.js 15.x, 16.x, 14.3.0-canary.77+; fixed in 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+
  • Meta React 19.0.0, 19.1.0–19.1.1, 19.2.0; fixed in 19.0.1, 19.1.2, 19.2.1
  • Vite @vitejs/plugin-rsc ≤0.5.2; fixed in 0.5.3

Timeline

  • 2025-12-03: disclosed: Vulnerability publicly disclosed via GitHub Security Advisories (GHSA-fv66-9v8q-g76r, GHSA-9qr9-h5gf-34mp, GHSA-fmh4-wr37-44fp)
  • 2025-12-03: patched: Patches released: React 19.0.1, 19.1.2, 19.2.1; Next.js 15.0.5+, 16.0.7+; @vitejs/plugin-rsc 0.5.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.