Junglewise Threat Intelligence

React Server Components remote code execution via deserialization

Severity: low · CVSS 3.1 · Published 2025-12-03

Technologies: Meta React, @vitejs/plugin-rsc (npm), Meta React Server Components (Parcel), Vercel Next.js, Meta React Server Components (Webpack), Meta React Server Components (Turbopack), Vite Plugin-Rsc. Vendors: Meta, npm, Vercel, Vite.

Executive brief

React Server Components, which power server-side rendering in modern web frameworks like Next.js, contain a critical vulnerability allowing unauthenticated attackers to execute arbitrary code on affected servers. The flaw exists in how React deserializes untrusted data from clients, enabling full compromise of application confidentiality, integrity, and availability without any authentication or user interaction required.

Technical details

The vulnerability is a deserialization attack (CWE-502) in React's server-side rendering packages (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack). These packages fail to properly validate and sanitize untrusted client-supplied data before deserializing it, allowing attackers to craft malicious serialized payloads that execute arbitrary code on the server. The flaw affects versions 19.0.0, 19.1.0–19.1.1, and 19.2.0; no authentication is required and the attack is network-reachable. Patches were released in React versions 19.0.1, 19.1.2, and 19.2.1. Downstream frameworks like Next.js (versions 15.x, 16.x, and canary 14.3.0-canary.77+) are also affected when using React Server Components, with corresponding patches available.

Affected products

  • Meta react-server-dom-webpack 19.0.0, 19.1.0–19.1.1, 19.2.0; fixed in 19.0.1, 19.1.2, 19.2.1
  • Meta react-server-dom-parcel 19.0.0, 19.1.0–19.1.1, 19.2.0; fixed in 19.0.1, 19.1.2, 19.2.1
  • Meta react-server-dom-turbopack 19.0.0, 19.1.0–19.1.1, 19.2.0; fixed in 19.0.1, 19.1.2, 19.2.1
  • Vercel Next.js 15.x, 16.x, 14.3.0-canary.77+; fixed in 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+
  • Meta React 19.0.0, 19.1.0–19.1.1, 19.2.0; fixed in 19.0.1, 19.1.2, 19.2.1
  • Vite @vitejs/plugin-rsc ≤0.5.2; fixed in 0.5.3

Timeline

  • 2025-12-03: disclosed: Vulnerability publicly disclosed via GitHub Security Advisories (GHSA-fv66-9v8q-g76r, GHSA-9qr9-h5gf-34mp, GHSA-fmh4-wr37-44fp)
  • 2025-12-03: patched: Patches released: React 19.0.1, 19.1.2, 19.2.1; Next.js 15.0.5+, 16.0.7+; @vitejs/plugin-rsc 0.5.3

References

Related threats