Article Details
Scrape Timestamp (UTC): 2025-12-12 09:02:06.931
Source: https://thehackernews.com/2025/12/new-react-rsc-vulnerabilities-enable.html
Original Article Text
Click to Toggle View
New React RSC Vulnerabilities Enable DoS and Source Code Exposure. The React team has released fixes for two new types of flaws in React Server Components (RSC) that, if successfully exploited, could result in denial-of-service (DoS) or source code exposure. The team said the issues were found by the security community while attempting to exploit the patches released for CVE-2025-55182 (CVSS score: 10.0), a critical bug in RSC that has since been weaponized in the wild. The three vulnerabilities are listed below - However, successful exploitation of CVE-2025-55183 requires the existence of a Server Function that explicitly or implicitly exposes an argument that has been converted into a string format. The flaws affecting the following versions of react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack - Security researcher RyotaK and Shinsaku Nomura have been credited with reporting the two DoS bugs to the Meta Bug Bounty program, while Andrew MacPherson has been acknowledged for reporting the information leak flaw. Users are advised to update to versions 19.0.3, 19.1.4, and 19.2.3 as soon as possible, particularly in light of active exploration of CVE-2025-55182. "When a critical vulnerability is disclosed, researchers scrutinize adjacent code paths looking for variant exploit techniques to test whether the initial mitigation can be bypassed," the React team said. "This pattern shows up across the industry, not just in JavaScript. Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle."
Daily Brief Summary
The React team has addressed two new vulnerabilities in React Server Components (RSC) that could lead to denial-of-service (DoS) attacks or source code exposure.
These issues emerged as the security community tested patches for CVE-2025-55182, a critical bug with a CVSS score of 10.0, already exploited in the wild.
Successful exploitation of CVE-2025-55183 requires a Server Function that exposes an argument in string format, affecting specific versions of react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack.
Security researchers RyotaK, Shinsaku Nomura, and Andrew MacPherson reported these vulnerabilities through the Meta Bug Bounty program, highlighting the importance of collaborative security efforts.
Users are urged to update to versions 19.0.3, 19.1.4, and 19.2.3 promptly, especially given the active exploitation of CVE-2025-55182.
The React team emphasized that additional vulnerability disclosures, while frustrating, indicate a robust response cycle and are common across the software industry.
This incident underscores the need for continuous vigilance and timely updates to mitigate potential security threats in widely-used software frameworks.