Executive brief
A vulnerability in a Vite plugin used for React Server Components could allow an attacker to crash or slow down a web application. This occurs because the plugin includes a flawed version of a React component library that does not properly manage system resources. An exploit could lead to a denial of service, making the application unavailable to legitimate users.
Technical details
The @vitejs/plugin-rsc package vendors react-server-dom-webpack, which is vulnerable to uncontrolled resource consumption (CWE-400) in versions prior to 19.2.4. This vulnerability allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via network requests targeting React Server Components. The issue is resolved in @vitejs/plugin-rsc version 0.5.23 by updating the vendored dependency. The attack complexity is low and requires no user interaction.
Affected products
- Vite @vitejs/plugin-rsc <= 0.5.22
Timeline
- 2026-04-08: disclosed
- 2026-04-10: advisory