Executive brief
Vite Plugin React is a build tool plugin for React applications. A vulnerability in its React Server Components support can be exploited by remote attackers to cause a denial of service, making the application unavailable to legitimate users without requiring authentication or user interaction.
Technical details
The vulnerability exists in @vitejs/plugin-rsc, which vendors react-server-dom-webpack prior to version 19.2.3. This is a denial of service flaw affecting React Server Components processing. The attack is network-accessible without requiring authentication or user interaction, and an attacker can craft malicious requests that exhaust server resources and crash the application. The fix requires upgrading to @vitejs/plugin-rsc version 0.5.7 or later, which includes the patched react-server-dom-webpack dependency.
Affected products
- Vite Plugin React <= 0.5.6
Timeline
- 2025-12-12: disclosed