Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 10 April 2026.

Which products and versions are affected?

@vitejs/plugin-rsc (npm) SEMVER:introduced=0,fixed=0.5.23.

Is there a fix for This vulnerability?

Yes. @vitejs/plugin-rsc (npm): upgrade to 0.5.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run @vitejs/plugin-rsc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Vitejs plugin-rsc Denial of Service with React Server Components

Severity: low · CVSS 3.1 · Published 2026-04-10

@vitejs/plugin-rsc is a Vite plugin used to integrate React Server Components into React projects. The plugin vendors a vulnerable version of react-server-dom-webpack, which can be exploited by remote attackers to trigger a denial of service, causing the application to become unavailable without requiring authentication or user interaction.

Technologies: @vitejs/plugin-rsc (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 10 April 2026.
Which products and versions are affected?: @vitejs/plugin-rsc (npm) SEMVER:introduced=0,fixed=0.5.23.
Is there a fix for This vulnerability?: Yes. @vitejs/plugin-rsc (npm): upgrade to 0.5.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run @vitejs/plugin-rsc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@vitejs/plugin-rsc (npm): upgrade to 0.5.23 or later
```
npm install @vitejs/plugin-rsc@0.5.23
```

Technical details

The vulnerability exists in vendored react-server-dom-webpack versions prior to 19.2.4, which is contained within @vitejs/plugin-rsc versions up to 0.5.22. The issue is classified as a denial of service (CWE-400) accessible over the network with no authentication required, no user interaction needed, and low attack complexity. An unauthenticated remote attacker can exploit this to cause high availability impact, making the affected application unavailable. The vulnerability has been patched in @vitejs/plugin-rsc version 0.5.23 and later.

Affected products

Vitejs plugin-rsc <=0.5.22

Timeline

2026-04-10: disclosed
2026-04-10: patched: Fixed in version 0.5.23

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.