GitHub Advisoryadvisory · npm

GHSA-cpqf-f22c-r95x Vite Plugin React has a Denial of Service Vulnerability in React Server Components

HIGH Published 2025-12-12 Modified 2025-12-12 Official page ↗
Ecosystem
npm
Packages
@vitejs/plugin-rsc
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1395, CWE-400, CWE-502
Reviewed
2025-12-12

Affected packages

• npm @vitejs/plugin-rsc: < 0.5.7 → fixed in 0.5.7

Description

Impact `@vitejs/plugin-rsc` vendors `react-server-dom-webpack`, which contained a vulnerability in versions prior to 19.2.3. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-7gmr-mq3h-m5h9 Patches Upgrade immediately to `@vitejs/[email protected]` or later.

Related

Weakness · CWE (3)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness
  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References