Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 12 December 2025.

Which products and versions are affected?

@vitejs/plugin-rsc (npm) SEMVER:introduced=0,fixed=0.5.7; Vite Plugin React <= 0.5.6.

Is there a fix for This vulnerability?

Yes. @vitejs/plugin-rsc (npm): upgrade to 0.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run @vitejs/plugin-rsc (npm) or Vite Plugin React at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Vite Plugin React denial of service in React Server Components

Q: Is there a fix for This vulnerability?

Yes. @vitejs/plugin-rsc (npm): upgrade to 0.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run @vitejs/plugin-rsc (npm) or Vite Plugin React at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: low · CVSS 3.1 · Published 2025-12-12

Vite Plugin React is a build tool plugin for React applications. A vulnerability in its React Server Components support can be exploited by remote attackers to cause a denial of service, making the application unavailable to legitimate users without requiring authentication or user interaction.

Technologies: @vitejs/plugin-rsc (npm). Vendors: npm, Vite.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 12 December 2025.
Which products and versions are affected?: @vitejs/plugin-rsc (npm) SEMVER:introduced=0,fixed=0.5.7; Vite Plugin React <= 0.5.6.
Is there a fix for This vulnerability?: Yes. @vitejs/plugin-rsc (npm): upgrade to 0.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run @vitejs/plugin-rsc (npm) or Vite Plugin React at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@vitejs/plugin-rsc (npm): upgrade to 0.5.7 or later
```
npm install @vitejs/plugin-rsc@0.5.7
```

Technical details

The vulnerability exists in @vitejs/plugin-rsc, which vendors react-server-dom-webpack prior to version 19.2.3. This is a denial of service flaw affecting React Server Components processing. The attack is network-accessible without requiring authentication or user interaction, and an attacker can craft malicious requests that exhaust server resources and crash the application. The fix requires upgrading to @vitejs/plugin-rsc version 0.5.7 or later, which includes the patched react-server-dom-webpack dependency.

Affected products

Vite Plugin React <= 0.5.6

Timeline

2025-12-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.