CVE-2025-55183: React Server Components source code exposure, and how to fix it

What CVE-2025-55183 does

React Server Components run part of a React app on the server. Server Functions, called Server Actions in Next.js, are the functions marked "use server" that the browser calls over HTTP, when a form is submitted for example. React decodes the arguments of each call on the server. In the React server packages 19.0.0, 19.0.1, 19.1.0 to 19.1.2, 19.2.0 and 19.2.1, a crafted request could get a Server Function to hand back code instead of data: the CVE record says it "may unsafely return the source code of any Server Function".

There is one condition. The function has to turn one of its arguments into text that the caller can see. React's advisory gives the two shapes this takes:

• Explicit: the function puts the argument in its reply, like a greeting that inserts the submitted name. In React's own example, the reply contained the whole compiled function, with a database key that was written in the code.
• Implicit: the function stores the argument as text somewhere the caller can read back later, such as a user name saved in the database.

What leaks is the code inside the Server Function, plus any other functions your bundler inlined into it. The Next.js advisory describes it as the compiled source code of other Server Functions in your application, which "could reveal business logic".

What a stranger can and cannot get

Severity and exploitation status

Meta, the CNA (the organization that assigned the CVE), scores it 5.3, medium, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. In plain words: reachable over the network, low complexity, no account and no user action needed, a limited impact on confidentiality, and none on integrity or availability. NVD shows Meta's score and has not added one of its own. GitHub's advisories for React and Next.js also rate it 5.3, medium.

CVE-2025-55183 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog as of its November 6, 2026 release, while the related React2Shell CVE has been listed since December 5, 2025. CISA's assessment, added to the CVE record in January 2026, rates exploitation as proof of concept and the attack as automatable: React's advisory itself shows what a leaked reply looks like. We found no credible public report of exploitation in the wild, so this page marks it as unknown rather than no.

Who is affected

If you upgraded for React2Shell in early December 2025 and stopped there, you are affected: React 19.0.1, 19.1.2 and 19.2.1, the versions that fixed it, are in the affected range of this CVE.

The version is half the story. The leak also needs a Server Function that reflects or stores an argument as text, and an app with forms often has one: a contact form that saves the message, a profile action that saves a display name, an action that answers with what you typed. Reviewing every function takes longer than upgrading, and the upgrade also fixes the denial of service CVEs, which React says can hit an app even without any Server Function.

Hosted on Vercel or self-hosted

The installed version decides, wherever you host. Vercel added WAF rules (a web application firewall filters requests before they reach your app) for this CVE to every project at no cost, and blocks new deployments of vulnerable versions. It also states that WAF rules cannot guarantee protection against every variant. React's advisory says the same of every hosting provider mitigation: do not depend on them. On a server you run yourself, with next start, a container or a VPS, nothing filters these requests unless you set it up.

One more detail on Vercel: old deployments keep running old code. A preview URL built before the fix still answers with the vulnerable version, which is why Vercel recommends Standard Protection on every deployment except production.

How to check if your app is affected

Read the installed version, not the range in package.json: "next": "^15.1.0" can still be locked to 15.1.0. At the root of your project:

# npm
npm ls next

# pnpm (add -r in a monorepo)
pnpm why next

# yarn
yarn why next

# other RSC frameworks: the React server packages
npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel

The lockfile is what your host installs at build time. In a monorepo, check every app that has its own next dependency:

# package-lock.json
grep -A1 '"node_modules/next"' package-lock.json

# pnpm-lock.yaml
grep -E '^  /?next@' pnpm-lock.yaml

# yarn.lock
grep -A1 -E '^"?next@' yarn.lock

Check what production runs

A fixed repository does not fix a build that was never redeployed. Open your live site, open the browser console and type next.version: Vercel's bulletin gives it as the way to read the running version. To see whether production answers React Server Components requests at all, send your own app the RSC header that Next.js uses for them:

curl -s -o /dev/null -D - -H "RSC: 1" https://your-app.example/ | grep -i content-type

Find the functions that could leak

If you cannot upgrade today, list your Server Functions and look for two things: an argument that ends up in a reply or in stored text, and a secret written in the code.

# files that declare Server Functions
grep -rlE "[\"']use server[\"']" app src lib --include='*.ts' --include='*.tsx' --include='*.js' --include='*.jsx'

# string literals that look like keys
grep -rniE "(key|secret|token|password)[A-Za-z_]*\s*[:=]\s*[\"'][^\"']{16,}" app src lib

How to fix CVE-2025-55183

Upgrade: the Next.js advisory says there is no workaround. Two sources give two numbers for Next.js. GitHub's advisory for Next.js lists the release that first removed the leak, while the Next.js blog and NVD list the following patch, which also completed the denial of service fix (CVE-2025-67779). Take the later one at least.

In practice, move to a line that still gets security fixes. The Next.js security release of November 3, 2026 ships 16.4.5 (Active LTS) and 15.5.29 (Maintenance LTS), both past every fix listed on this page:

# Next.js 16
npm install [email protected]

# Next.js 15
npm install [email protected]

# the same with pnpm or yarn
pnpm add [email protected]
yarn add [email protected]

From any 15.x release, 15.5.29 is the smaller step; going to 16 is a major upgrade to test first. With React Router, Waku, RedwoodSDK, Parcel or the Vite plugin, upgrade every react-server-dom-* package to 19.0.8, 19.1.9 or 19.2.8 at least: more denial of service advisories followed in 2026, the newest being CVE-2026-44907 in July. The 19.3 line, npm's current latest, is not listed as affected. Then rebuild and redeploy: on Vercel, pushing the change builds a preview and merging promotes it to production.

What to do after upgrading

• Open the live site and check that next.version in the console shows the patched release.
• Protect or delete preview deployments built before the fix: they still run the old code and answer the same requests.
• Search your Server Functions for secrets written in the code. Move each one to an environment variable read at runtime, then rotate it as if it leaked. Vercel recommends rotation only for secrets stored as plain text in your codebase, since runtime values were not exposed. What to do when an API key leaks gives the order of operations.
• Open next.config and check its env option: Next.js inlines those values at build time, so secrets do not belong there.
• Treat the logic of your Server Functions as public from now on. Next.js says every Server Action is reachable by a direct POST request, so each one has to check authentication and authorization itself. A rule that only lived in the UI is a hole, the kind described in the IDOR guide.
• If you stopped at 15.0.6 to 16.0.9, upgrade again: those versions still carry the denial of service that CVE-2025-67779 fixed.

Related CVEs in the same family

React's advisory says these flaws sit in the same packages and versions as React2Shell. Each one has its own page:

• CVE-2025-55182, React2Shell: remote code execution in the same code, disclosed the week before and in CISA's KEV catalog since December 5, 2025. Its patched versions are affected by CVE-2025-55183.
• CVE-2025-55184: a denial of service published the same day, high severity (CVSS 7.5), which also reaches Next.js 13.3 and 14.
• CVE-2025-67779: the complete fix for that denial of service, issued the same day after the first fix fell short.
• CVE-2026-23864: more denial of service cases, patched on January 26, 2026 in React 19.0.4, 19.1.5 and 19.2.4. Three more denial of service advisories followed between April and July 2026.

Timeline

What Keybrum checks on a live app

Keybrum's engine has no probe that makes a Server Function return its code, so for this CVE it proves the surface, not the bug. With one ordinary request carrying the RSC header, it confirms that your production domain answers the React Server Components protocol, counts the Server Action ids your JavaScript ships, and the report names the Next.js floor that covers the whole family: 16.4.5 or 15.5.29 today. The version checks above tell you whether that surface runs a fixed release.

Keybrum does attack the holes that cause the damage once code or keys get out: secrets in your JavaScript bundle (OpenAI, Stripe, Supabase service role, private keys), unprotected AI endpoints, and data one account can read from another. The Next.js security guide covers the rest of the framework, and vibe coding security risks covers what AI-built apps leak most often.