CVE-2025-55183

MEDIUM

React Server Components <19.3 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 7 public exploits for CVE-2025-55183. PoCs published by williavs, kimtruth, StealthMoud.

AI-analyzed exploit summary This repository provides a script to automate the patching of Next.js applications affected by CVE-2025-55183 (Source Code Exposure) and related vulnerabilities. It uses the official Vercel fix tool to scan and update dependencies across GitHub repositories.

Description

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

Exploits (7)

nomisec SCANNER 8 stars
by williavs · poc
https://github.com/williavs/nextjs-security-update

This repository provides a script to automate the patching of Next.js applications affected by CVE-2025-55183 (Source Code Exposure) and related vulnerabilities. It uses the official Vercel fix tool to scan and update dependencies across GitHub repositories.

Classification
Scanner 95%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Next.js (versions affected by CVE-2025-55183, CVE-2025-55184, CVE-2025-67779)
Auth required
Prerequisites: GitHub CLI authenticated access · jq · git · Node.js/npx
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 8 stars
by kimtruth · poc
https://github.com/kimtruth/CVE-2025-55183-poc

This repository provides a Nuclei template for detecting CVE-2025-55183, a source code disclosure vulnerability in Next.js React Server Components (RSC) / Server Actions. The vulnerability allows attackers to retrieve server-side JavaScript source code via crafted HTTP requests.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Next.js with React Server Components / Server Actions
No auth needed
Prerequisites: Access to the target Next.js application · Nuclei v3+
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 4 stars
by StealthMoud · poc
https://github.com/StealthMoud/react-server-cve-lab

This repository contains a working proof-of-concept for CVE-2025-55183 (source code exposure) and CVE-2025-55184 (denial of service) in React Server Components. It includes a vulnerable application, scanner, and exploit scripts for both vulnerabilities.

Classification
Working Poc 95%
Attack Type
Info Leak, Dos
Complexity
Moderate
Reliability
Reliable
Target: React Server Components 19.0.0-19.2.2
No auth needed
Prerequisites: Docker and Docker Compose · Python 3.7+ · Git
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 4 stars
by X-Cotang · poc
https://github.com/X-Cotang/CVE-2025-55183_POC

This PoC exploits a source code disclosure vulnerability in Next.js React Server Components (RSC) by crafting a malicious HTTP request to leak server function source code. It automates the discovery of JavaScript chunks, extraction of action IDs, and exploitation via a multipart/form-data payload.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Next.js (React Server Components)
No auth needed
Prerequisites: Target running a vulnerable version of Next.js with RSC enabled · Network access to the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WORKING POC 2 stars
by adminlove520 · pythonpoc
https://github.com/adminlove520/CVE-Poc_All_in_One/tree/main/2025/CVE-2025-55183

The repository contains functional exploit code for multiple CVEs, including authentication bypass vulnerabilities in TOTOLINK devices and a scanner for Fortinet SSL VPN (CVE-2024-21762). The PoCs demonstrate the vulnerabilities with clear technical details and functional code.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: TOTOLINK LR350, TOTOLINK T6, Fortinet SSL VPN
No auth needed
Prerequisites: network access to the target device
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 2 stars
by Saturate · poc
https://github.com/Saturate/CVE-2025-55183

This repository contains a scanner for CVE-2025-55183, which exploits a vulnerability in React Server Functions to expose source code and secrets. The scanner extracts Server Action IDs and sends crafted POST requests to trigger the vulnerability.

Classification
Working Poc | Scanner 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: React 19.0.0-19.2.1
No auth needed
Prerequisites: Target must be using React Server Functions · Server Actions must be present in the application
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by omaidnebari · poc
https://github.com/omaidnebari/RSC-Scanner-POC

This repository contains a Python-based scanner for detecting CVE-2025-55183, a Next.js React Server Components (RSC) source code disclosure vulnerability. The scanner automates the discovery of vulnerable endpoints by extracting JavaScript chunk paths and server action IDs, then testing for source code leakage via malicious requests.

Classification
Working Poc | Scanner 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Next.js (React Server Components)
No auth needed
Prerequisites: Python 3.7+ · requests library · urllib3 library · target running vulnerable Next.js RSC
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 5.3
EPSS 0.2631
EPSS Percentile 96.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

Status published
Products (5)
facebook/react 19.0.0 - 19.0.2
npm/react-server-dom-parcel 19.0.0 - 19.0.2npm
npm/react-server-dom-turbopack 19.0.0 - 19.0.2npm
npm/react-server-dom-webpack 19.0.0 - 19.0.2npm
vercel/next.js 15.6.0 (46 CPE variants)
Published Dec 11, 2025
Tracked Since Feb 18, 2026