What is GHSA-925w-6v3x-g4j4?

GHSA-925w-6v3x-g4j4 is a security advisory published by GitHub Security Advisories with Medium severity. Source Code Exposure Vulnerability in React Server Components

Which CVE IDs does GHSA-925w-6v3x-g4j4 cover?

GHSA-925w-6v3x-g4j4 covers the following CVE IDs: CVE-2025-55183. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-925w-6v3x-g4j4?

GHSA-925w-6v3x-g4j4 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-925w-6v3x-g4j4?

GHSA-925w-6v3x-g4j4 affects 9 products, including: npm/react-server-dom-parcel:\u003e= 19.0.0, \u003c 19.0.2; npm/react-server-dom-turbopack:\u003e= 19.0.0, \u003c 19.0.2; npm/react-server-dom-webpack:\u003e= 19.0.0, \u003c 19.0.2; npm/react-server-dom-parcel:\u003e= 19.1.0, \u003c 19.1.3; npm/react-server-dom-parcel:\u003e= 19.2.0, \u003c 19.2.2; and others — see the full list on the advisory page.

GHSA-925w-6v3x-g4j4MediumCVSS 5.3

Source Code Exposure Vulnerability in React Server Components

Vendor

GitHub Security Advisories

Published

December 11, 2025

Last Modified

December 11, 2025

🔗 CVE IDs covered (1)

CVE-2025-55183 →

📋 Description

Impact

There is a source code exposure vulnerability in React Server Components.

React recommends updating immediately.

The vulnerability exists in versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of:

These issues are present in the patches published last week.

Patches

Fixes were back ported to versions 19.0.2, 19.1.3, and 19.2.2.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References

See the blog post for more information and upgrade instructions.

🎯 Affected products9

npm/react-server-dom-parcel:>= 19.0.0, < 19.0.2
npm/react-server-dom-turbopack:>= 19.0.0, < 19.0.2
npm/react-server-dom-webpack:>= 19.0.0, < 19.0.2
npm/react-server-dom-parcel:>= 19.1.0, < 19.1.3
npm/react-server-dom-parcel:>= 19.2.0, < 19.2.2
npm/react-server-dom-turbopack:>= 19.1.0, < 19.1.3
npm/react-server-dom-turbopack:>= 19.2.0, < 19.2.2
npm/react-server-dom-webpack:>= 19.1.0, < 19.1.3
npm/react-server-dom-webpack:>= 19.2.0, < 19.2.2