Medium
Security advisory
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-55183
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:45 UTC · Revision 1
Source evidence
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
osv:CVE-2025-55183
Complete source record
{
"id": "5938ca402ac8815be6172069a69f309d957b4d9bed15c9c3fa47238d79ba02cd",
"url": "https://osv.dev/vulnerability/CVE-2025-55183",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2025-55183",
"summary": "An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.",
"evidence": "osv:CVE-2025-55183",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-55183",
"aliases": [
"CVE-2025-55183",
"GHSA-925w-6v3x-g4j4"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/react/react",
"type": "GIT",
"events": [
{
"introduced": "7aa5dda3b3e4c2baa905a59b922ae7ec14734b24"
},
{
"fixed": "61c95d04a87164c0a2cae7b2e055729a38a39be6"
},
{
"introduced": "4a9df08157f001c01b078d259748512211233dcf"
},
{
"fixed": "cff62b6370b29cf657899cc8397eaade5eceb58c"
},
{
"introduced": "ae74234eae6ebd62f19190731278e20bc1c37d51"
},
{
"fixed": "b910fc15e38d4fa80003819ddb7a928a3c3dca5d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "19.0.0"
},
{
"fixed": "19.0.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "19.1.0"
},
{
"fixed": "19.1.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "19.2.0"
},
{
"fixed": "19.2.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v19.0.1",
"v19.1.2",
"v19.2.1",
"v19.1.1",
"v19.0.0",
"v19.2.0",
"v19.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55183.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/vercel/next.js",
"type": "GIT",
"events": [
{
"introduced": "51bfe3c1863b191f4b039bc230e8ed5c57b0baf3"
},
{
"fixed": "fc9d731d04b677e07fd54f8a7cc4d2e7d0955731"
},
{
"introduced": "dafcd43fac3ef9d0ffd94f9c94fd61db4449df25"
},
{
"fixed": "1bedcab981dc21dbb0050f26a8dfd0eab2443ed5"
},
{
"introduced": "b0416fbb44d1d148b6322ed79b6448d588260e49"
},
{
"fixed": "fc3b7c50d41d7061bf9aea2530a634c56aa53017"
},
{
"introduced": "b2ff04995be722a5c93225e16e1c7fcc8bb53f91"
},
{
"fixed": "ecda06cd7ee9fe055f9c07b46772ecc18b8160c4"
},
{
"introduced": "7ad467409b67691ae4f5dc4dc47f1a247c4ba988"
},
{
"fixed": "43cb5460c809ab97b6547b7765542cf16adcfc3c"
},
{
"introduced": "7e08c8223d64bc2add7a0e5a323cbce0a84bb292"
},
{
"fixed": "c5de33e93ccccaf3bee60cf50603e2152f9886e1"
},
{
"introduced": "950609f96f694c5475d18cd2d72a0052ca04d4b9"
},
{
"fixed": "581dee67e280b96c0766172cbd5477102c03342b"
},
{
"introduced": "c654bec6eb08382ed2ef47c90317039b6693f62a"
},
{
"last_affected": "a8f7b5467485647def4c0f4479a0a83bc4a3673a"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.11"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.2.0"
},
{
"fixed": "15.2.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.3.0"
},
{
"fixed": "15.3.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.4.0"
},
{
"fixed": "15.4.10"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.5.0"
},
{
"fixed": "15.5.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.0.0"
},
{
"fixed": "16.0.10"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-NA"
},
{
"last_affected": "15.6.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary0"
},
{
"last_affected": "15.6.0-canary0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary1"
},
{
"last_affected": "15.6.0-canary1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary10"
},
{
"last_affected": "15.6.0-canary10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary11"
},
{
"last_affected": "15.6.0-canary11"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary12"
},
{
"last_affected": "15.6.0-canary12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary13"
},
{
"last_affected": "15.6.0-canary13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary14"
},
{
"last_affected": "15.6.0-canary14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary15"
},
{
"last_affected": "15.6.0-canary15"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary16"
},
{
"last_affected": "15.6.0-canary16"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary17"
},
{
"last_affected": "15.6.0-canary17"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary18"
},
{
"last_affected": "15.6.0-canary18"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary19"
},
{
"last_affected": "15.6.0-canary19"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary2"
},
{
"last_affected": "15.6.0-canary2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary20"
},
{
"last_affected": "15.6.0-canary20"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary21"
},
{
"last_affected": "15.6.0-canary21"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary22"
},
{
"last_affected": "15.6.0-canary22"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary23"
},
{
"last_affected": "15.6.0-canary23"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary24"
},
{
"last_affected": "15.6.0-canary24"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary25"
},
{
"last_affected": "15.6.0-canary25"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary26"
},
{
"last_affected": "15.6.0-canary26"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary27"
},
{
"last_affected": "15.6.0-canary27"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary28"
},
{
"last_affected": "15.6.0-canary28"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary29"
},
{
"last_affected": "15.6.0-canary29"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary3"
},
{
"last_affected": "15.6.0-canary3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary30"
},
{
"last_affected": "15.6.0-canary30"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary31"
},
{
"last_affected": "15.6.0-canary31"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary32"
},
{
"last_affected": "15.6.0-canary32"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary33"
},
{
"last_affected": "15.6.0-canary33"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary34"
},
{
"last_affected": "15.6.0-canary34"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary35"
},
{
"last_affected": "15.6.0-canary35"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary36"
},
{
"last_affected": "15.6.0-canary36"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary37"
},
{
"last_affected": "15.6.0-canary37"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary38"
},
{
"last_affected": "15.6.0-canary38"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary39"
},
{
"last_affected": "15.6.0-canary39"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary4"
},
{
"last_affected": "15.6.0-canary4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary40"
},
{
"last_affected": "15.6.0-canary40"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary41"
},
{
"last_affected": "15.6.0-canary41"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary42"
},
{
"last_affected": "15.6.0-canary42"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary43"
},
{
"last_affected": "15.6.0-canary43"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary44"
},
{
"last_affected": "15.6.0-canary44"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary45"
},
{
"last_affected": "15.6.0-canary45"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary46"
},
{
"last_affected": "15.6.0-canary46"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary47"
},
{
"last_affected": "15.6.0-canary47"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary48"
},
{
"last_affected": "15.6.0-canary48"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary49"
},
{
"last_affected": "15.6.0-canary49"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary5"
},
{
"last_affected": "15.6.0-canary5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary50"
},
{
"last_affected": "15.6.0-canary50"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary51"
},
{
"last_affected": "15.6.0-canary51"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary52"
},
{
"last_affected": "15.6.0-canary52"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary53"
},
{
"last_affected": "15.6.0-canary53"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary54"
},
{
"last_affected": "15.6.0-canary54"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary55"
},
{
"last_affected": "15.6.0-canary55"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary56"
},
{
"last_affected": "15.6.0-canary56"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary57"
},
{
"last_affected": "15.6.0-canary57"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary58"
},
{
"last_affected": "15.6.0-canary58"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary59"
},
{
"last_affected": "15.6.0-canary59"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary6"
},
{
"last_affected": "15.6.0-canary6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary7"
},
{
"last_affected": "15.6.0-canary7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary8"
},
{
"last_affected": "15.6.0-canary8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary9"
},
{
"last_affected": "15.6.0-canary9"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:-:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-NA"
},
{
"last_affected": "16.1.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary0:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary0"
},
{
"last_affected": "16.1.0-canary0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary1:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary1"
},
{
"last_affected": "16.1.0-canary1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary10:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary10"
},
{
"last_affected": "16.1.0-canary10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary11:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary11"
},
{
"last_affected": "16.1.0-canary11"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary12:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary12"
},
{
"last_affected": "16.1.0-canary12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary13:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary13"
},
{
"last_affected": "16.1.0-canary13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary14:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary14"
},
{
"last_affected": "16.1.0-canary14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary15:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary15"
},
{
"last_affected": "16.1.0-canary15"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary16:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary16"
},
{
"last_affected": "16.1.0-canary16"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary17:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary17"
},
{
"last_affected": "16.1.0-canary17"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary18:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary18"
},
{
"last_affected": "16.1.0-canary18"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary2:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary2"
},
{
"last_affected": "16.1.0-canary2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary3:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary3"
},
{
"last_affected": "16.1.0-canary3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary4:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary4"
},
{
"last_affected": "16.1.0-canary4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary5:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary5"
},
{
"last_affected": "16.1.0-canary5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary6:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary6"
},
{
"last_affected": "16.1.0-canary6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary7:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary7"
},
{
"last_affected": "16.1.0-canary7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary8:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary8"
},
{
"last_affected": "16.1.0-canary8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.1.0:canary9:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.1.0-canary9"
},
{
"last_affected": "16.1.0-canary9"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"15.6.0-NA",
"15.6.0-canary1",
"15.6.0-canary10",
"15.6.0-canary11",
"15.6.0-canary12",
"15.6.0-canary13",
"15.6.0-canary14",
"15.6.0-canary15",
"15.6.0-canary16",
"15.6.0-canary17",
"15.6.0-canary18",
"15.6.0-canary19",
"15.6.0-canary2",
"15.6.0-canary20",
"15.6.0-canary21",
"15.6.0-canary22",
"15.6.0-canary23",
"15.6.0-canary24",
"15.6.0-canary25",
"15.6.0-canary26",
"15.6.0-canary27",
"15.6.0-canary28",
"15.6.0-canary29",
"15.6.0-canary3",
"15.6.0-canary30",
"15.6.0-canary31",
"15.6.0-canary32",
"15.6.0-canary33",
"15.6.0-canary34",
"15.6.0-canary35",
"15.6.0-canary36",
"15.6.0-canary37",
"15.6.0-canary38",
"15.6.0-canary39",
"15.6.0-canary4",
"15.6.0-canary40",
"15.6.0-canary41",
"15.6.0-canary42",
"15.6.0-canary43",
"15.6.0-canary44",
"15.6.0-canary45",
"15.6.0-canary46",
"15.6.0-canary47",
"15.6.0-canary48",
"15.6.0-canary49",
"15.6.0-canary5",
"15.6.0-canary50",
"15.6.0-canary51",
"15.6.0-canary52",
"15.6.0-canary53",
"15.6.0-canary54",
"15.6.0-canary55",
"15.6.0-canary56",
"15.6.0-canary57",
"15.6.0-canary58",
"15.6.0-canary59",
"15.6.0-canary6",
"15.6.0-canary7",
"15.6.0-canary8",
"15.6.0-canary9",
"16.1.0-NA",
"16.1.0-canary0",
"16.1.0-canary1",
"16.1.0-canary10",
"16.1.0-canary11",
"16.1.0-canary12",
"16.1.0-canary13",
"16.1.0-canary14",
"16.1.0-canary15",
"16.1.0-canary16",
"16.1.0-canary17",
"16.1.0-canary18",
"16.1.0-canary2",
"16.1.0-canary3",
"16.1.0-canary4",
"16.1.0-canary5",
"16.1.0-canary6",
"16.1.0-canary7",
"16.1.0-canary8",
"16.1.0-canary9",
"v15.0.6",
"v15.1.10",
"v15.2.7",
"v15.3.7",
"v15.4.9",
"v15.5.8",
"v16.0.9",
"v15.2.6",
"v15.3.6",
"v16.0.8",
"v15.5.7",
"v15.4.8",
"v15.1.9",
"v15.0.5",
"v16.0.7",
"v15.5.6",
"v15.3.5",
"v15.2.5",
"v15.1.8",
"v16.0.6",
"v15.0.4",
"v16.1.0-canary.9",
"v16.1.0-canary.8",
"v16.0.5",
"v16.1.0-canary.7",
"v16.1.0-canary.4",
"v16.1.0-canary.6",
"v16.1.0-canary.5",
"v16.0.4",
"v16.1.0-canary.3",
"v16.1.0-canary.2",
"v16.1.0-canary.1",
"v16.1.0-canary.0",
"v16.0.3",
"v16.0.2-canary.34",
"v16.0.2-canary.33",
"v16.0.2-canary.32",
"v16.0.2-canary.31",
"v16.0.2-canary.30",
"v16.0.2-canary.29",
"v16.0.2-canary.28",
"v16.0.2-canary.27",
"v16.0.2-canary.26",
"v16.0.2-canary.25",
"v16.0.2-canary.24",
"v16.0.2-canary.23",
"v16.0.2-canary.22",
"v16.0.2-canary.21",
"v16.0.2-canary.20",
"v16.0.2-canary.19",
"v16.0.2-canary.18",
"v16.0.2-canary.17",
"v16.0.2",
"v16.0.2-canary.16",
"v16.0.1",
"v16.0.2-canary.15",
"v16.0.2-canary.14",
"v16.0.2-canary.13",
"v16.0.2-canary.12",
"v16.0.2-canary.11",
"v16.0.2-canary.10",
"v16.0.2-canary.9",
"v16.0.2-canary.8",
"v16.0.2-canary.7",
"v16.0.2-canary.6",
"v16.0.2-canary.5",
"v16.0.2-canary.4",
"v16.0.2-canary.3",
"v16.0.2-canary.2",
"v16.0.2-canary.1",
"v16.0.2-canary.0",
"v16.0.1-canary.6",
"v16.0.1-canary.5",
"v16.0.1-canary.4",
"v16.0.1-canary.3",
"v16.0.1-canary.2",
"v16.0.1-canary.1",
"v16.0.1-canary.0",
"v16.0.0",
"v15.5.5",
"v15.4.7",
"v15.5.4",
"v15.5.3",
"v15.5.2",
"v15.5.1",
"v15.5.0",
"v15.4.6",
"v15.4.5",
"v15.4.4",
"v15.4.3",
"v15.4.2",
"v15.4.1",
"v15.4.0",
"v15.3.4",
"v15.3.3",
"v15.3.2",
"v15.3.1",
"v15.3.0",
"v15.2.4",
"v15.2.3",
"v15.2.2",
"v15.2.2-canary.6",
"v15.2.2-canary.5",
"v15.2.2-canary.4",
"v15.2.2-canary.3",
"v15.2.2-canary.2",
"v15.2.2-canary.1",
"v15.2.2-canary.0",
"v15.2.1",
"v15.2.1-canary.6",
"v15.2.1-canary.5",
"v15.2.1-canary.4",
"v15.2.1-canary.3",
"v15.2.1-canary.2",
"v15.2.1-canary.1",
"v15.2.1-canary.0",
"v15.2.0",
"v15.1.7",
"v15.1.6",
"v15.1.5",
"v15.1.4",
"v15.1.3",
"v15.1.2",
"v15.1.1",
"v15.1.0",
"v15.0.3",
"v15.0.3-canary.9",
"v15.0.3-canary.8",
"v15.0.3-canary.7",
"v15.0.3-canary.6",
"v15.0.3-canary.5",
"v15.0.3-canary.4",
"v15.0.3-canary.3",
"v15.0.3-canary.2",
"v15.0.3-canary.1",
"v15.0.3-canary.0",
"v15.0.2",
"v15.0.2-canary.11",
"v15.0.2-canary.10",
"v15.0.2-canary.9",
"v15.0.2-canary.8",
"v15.0.2-canary.7",
"v15.0.2-canary.6",
"v15.0.2-canary.5",
"v15.0.2-canary.4",
"v15.0.2-canary.3",
"v15.0.2-canary.2",
"v15.0.2-canary.1",
"v15.0.2-canary.0",
"v15.0.1",
"v15.0.1-canary.3",
"v15.0.1-canary.2",
"v15.0.1-canary.1",
"v15.0.1-canary.0",
"v15.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55183.json"
}
}
],
"modified": "2026-10-24T10:30:44.169751118Z",
"provider": "osv",
"references": [
"https://www.facebook.com/security/advisories/cve-2025-55183",
"https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2025-55183",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 435799,
"published_at": "2025-12-11T20:16:00.46+00:00"
}