CVE-2025-55183

Katalog CVE

CVSS 5.3 · Medium EPSS 64,2%

Kerentanan pada vercel next.js. Skor CVSS 3.1 5.3 (Medium) menurut fb.com.

Deskripsi (NVD)

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

Rincian

Terbit di NVD

11 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber fb.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

EPSS (30 hari)

64,2% peluang dieksploitasi; lebih tinggi dari 99,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 91 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components exploit · advisory vendor
• https://www.facebook.com/security/advisories/cve-2025-55183 advisory vendor