CVE-2025-55183

medium · 5.3

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

5.3

CVSS

64.2%

EPSS (exploit prob.)

99th

EPSS percentile

2025-12-11

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Vendor	Product	Affected versions
vercel	next.js	>= 15.0.0, < 15.0.7
vercel	next.js	>= 15.1.0, < 15.1.11
vercel	next.js	>= 15.2.0, < 15.2.8
vercel	next.js	>= 15.3.0, < 15.3.8
vercel	next.js	>= 15.4.0, < 15.4.10
vercel	next.js	>= 15.5.0, < 15.5.9
vercel	next.js	>= 16.0.0, < 16.0.10
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0
vercel	next.js	15.6.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-55183