CVE-2025-55183Medium· 5.3▾ TwilightPoC available

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score54/ 100 · Moderate

impact 29.2 · likelihood 12.8 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Dec 11, 2025

Updated

Oct 7, 2026

CVSS

5.3

Vendor

vercel

Product

next.js

CWE

—

Depth score

54 · Moderate

EPSS

64% · p99

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-07

GitHub PoCs

6 public repositories

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 301 days

Dec 11, 2025Published
Disclosed via NVD
Oct 7, 2026Record revised
Last analysed / modified upstream
Oct 7, 2026EPSS first tracked
64%
Oct 7, 2026Public exploit observed
6 GitHub repos (last check)

vercel #nvd #exploit-available

Affected

next.js >= 15.0.0, < 15.0.7
next.js >= 15.1.0, < 15.1.11
next.js >= 15.2.0, < 15.2.8
next.js >= 15.3.0, < 15.3.8
next.js >= 15.4.0, < 15.4.10
next.js >= 15.5.0, < 15.5.9
next.js >= 16.0.0, < 16.0.10
next.js = 15.6.0
next.js = 16.1.0
react >= 19.0.0, < 19.0.2
react >= 19.1.0, < 19.1.3
react >= 19.2.0, < 19.2.2

Patched in

next.js 16.0.10
react 19.2.2

Full technical detail▾

Overview

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

Affected

next.js >= 15.0.0, < 15.0.7
next.js >= 15.1.0, < 15.1.11
next.js >= 15.2.0, < 15.2.8
next.js >= 15.3.0, < 15.3.8
next.js >= 15.4.0, < 15.4.10
next.js >= 15.5.0, < 15.5.9
next.js >= 16.0.0, < 16.0.10
next.js = 15.6.0
next.js = 16.1.0
react >= 19.0.0, < 19.0.2
react >= 19.1.0, < 19.1.3
react >= 19.2.0, < 19.2.2

Remediation

Upgrade past the affected range:

next.js 16.0.10
react 19.2.2

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available

← Back to feed

CVE-2025-55183Medium· 5.3▾ TwilightPoC available

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score54/ 100 · Moderate

impact 29.2 · likelihood 12.8 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Dec 11, 2025

Updated

Oct 7, 2026

CVSS

5.3

Vendor

vercel

Product

next.js

CWE

—

Depth score

54 · Moderate

EPSS

64% · p99

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-07

GitHub PoCs

6 public repositories

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 301 days

Dec 11, 2025Published
Disclosed via NVD
Oct 7, 2026Record revised
Last analysed / modified upstream
Oct 7, 2026EPSS first tracked
64%
Oct 7, 2026Public exploit observed
6 GitHub repos (last check)

vercel #nvd #exploit-available

Affected

next.js >= 15.0.0, < 15.0.7
next.js >= 15.1.0, < 15.1.11
next.js >= 15.2.0, < 15.2.8
next.js >= 15.3.0, < 15.3.8
next.js >= 15.4.0, < 15.4.10
next.js >= 15.5.0, < 15.5.9
next.js >= 16.0.0, < 16.0.10
next.js = 15.6.0
next.js = 16.1.0
react >= 19.0.0, < 19.0.2
react >= 19.1.0, < 19.1.3
react >= 19.2.0, < 19.2.2

Patched in

next.js 16.0.10
react 19.2.2

Full technical detail▾

Overview

Affected

next.js >= 15.0.0, < 15.0.7
next.js >= 15.1.0, < 15.1.11
next.js >= 15.2.0, < 15.2.8
next.js >= 15.3.0, < 15.3.8
next.js >= 15.4.0, < 15.4.10
next.js >= 15.5.0, < 15.5.9
next.js >= 16.0.0, < 16.0.10
next.js = 15.6.0
next.js = 16.1.0
react >= 19.0.0, < 19.0.2
react >= 19.1.0, < 19.1.3
react >= 19.2.0, < 19.2.2

Remediation

Upgrade past the affected range:

next.js 16.0.10
react 19.2.2

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available