Denial of Service and Source Code Exposure in React Server Components
React has identified two new vulnerabilities, CVE-2025-55184 and CVE-2025-55183, affecting React Server Components. These flaws allow for Denial of Service attacks and unauthorized Source Code Exposure.
Verified State Diff
Impact & Verification Analysis
Developers and organizations utilizing React Server Components in production environments.
These vulnerabilities pose a direct risk to application availability and intellectual property security, requiring urgent updates to maintain the integrity of server-side rendering pipelines.
Full Fact Overview
Following the remediation of a previous critical vulnerability in React Server Components, security researchers discovered secondary exploit vectors. CVE-2025-55184 is classified as a high-severity Denial of Service vulnerability, while CVE-2025-55183 is a medium-severity vulnerability involving the exposure of internal source code. These issues stem from the handling of server-side component execution and data serialization, necessitating immediate patching to prevent remote exploitation.