GitHub Advisoryadvisory · npm

GHSA-v457-wxvj-p9w9 @vitejs/plugin-rsc has a Denial of Service with React Server Components

HIGH Published 2026-04-10 Modified 2026-04-10 Official page ↗

Ecosystem: npm
Packages: @vitejs/plugin-rsc
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-400
Reviewed: 2026-04-10

Affected packages

• npm @vitejs/plugin-rsc: < 0.5.23 → fixed in 0.5.23

Description

Impact `@vitejs/plugin-rsc` vendors `react-server-dom-webpack`, which contained a vulnerability in versions prior to 19.2.4. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg Patches Upgrade immediately to `@vitejs/[email protected]` or later.

Related

Weakness · CWE (1)

CWE-400 Uncontrolled Resource Consumption weakness

References