GitHub Advisoryadvisory · npm

GHSA-w94c-4vhp-22gx @vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components

HIGH Published 2026-05-11 Modified 2026-05-11 Official page ↗

Ecosystem: npm
Packages: @vitejs/plugin-rsc
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-770
Reviewed: 2026-05-11

Affected packages

• npm @vitejs/plugin-rsc: < 0.5.26 → fixed in 0.5.26

Description

Impact `@vitejs/plugin-rsc` vendors `react-server-dom-webpack`, which contained a vulnerability in versions prior to 19.2.6. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh Patches Upgrade immediately to `@vitejs/[email protected]` or later.

Related

Weakness · CWE (1)

CWE-770 Allocation of Resources Without Limits or Throttling weakness

References