VulnSocial

CVE-2025-55183Disclosure(facebook / next.js)

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch facebook next.js systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

facebook CVEsBack to dashboard
1.0/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • next.js
  • react

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 2 mentions (2026-02-26); latest day: 1
  • 4 total mentions across 3 days

Affected systems

Vendors
facebookvercel
Products
next.jsreact

2 versions affected across 2 products

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-02-26: 2Mentions · 2026-04-26: 1Mentions · 2026-05-07: 1Patch / Workaround · 2026-05-07: 1Technical Details · 2026-02-26: 2Technical Details · 2026-04-26: 1Technical Details · 2026-05-07: 102-2604-2605-07
Signal classification3 categories
Disclosure
250.0%
General
125.0%
Patch
125.0%
Referenced assets1 URL
Classification over time
DateTotalLabels
2026-02-262
Disclosure1General1
2026-04-261
Disclosure1
2026-05-071
Patch1
Full discourse4 posts
  • Stefano Saitta@nerder_
    Disclosure

    @rauchg Your non-vibecoded framework Next also had 1 critical (CVE-2025-66478), 1 high (CVE-2025-55184), and 1 medium (CVE-2025-55183) security vulnerabilities.

    Post summary

    The tweet announces that the non‑vibecoded framework Next has three vulnerabilities: one critical (CVE‑2025‑66478), one high (CVE‑2025‑55184), and one medium (CVE‑2025‑55183).

    00040144
    164 followersView on X
  • DataHogo@DataHogo
    Disclosure

    A Next.js Server Function could return its own source code as anHTTP response. CVE-2025-55183 — hardcoded secrets inside Server Functions were readable by anyone with the right malformed request. process.env was safe. String literals were not. https://www.datahogo.com/en/blog/cve-2025-55183-nextjs-server-function-source-code-leak

    Post summary

    Next.js Server Functions can expose their own source code and hard‑coded secrets when reached with a malformed request, indicating a potential source‑code leakage vulnerability.

    01000672
    3 followersView on X
  • Grok@grok
    Patch

    The vulnerabilities are: - CVE-2025-55182: Critical unauthenticated RCE in React Server Components (v19.0-19.2) & Next.js (15-16) via malicious payload deserialization to server functions. - CVE-2025-55183: Server function source leak via insufficient validation. - CVE-2025-55184: DoS via cyclical Promise refs causing recursion/lockup. Patch to React 19.2.1+ and latest Next.js now. Cloudflare WAF already blocks the DoS ones and is adding rules for others.

    Post summary

    The text announces critical vulnerabilities in React Server Components and Next.js, details their nature, and provides patch guidance and WAF protections, with no evidence of active exploitation or PoC.

    00000227
    8.7M followersView on X
  • Rodrigo Moreno@RodMoreno_
    General

    • CVE-2025-55183 — Source code exposure. • CVE-2026-23864 — Another DoS, CVSS 7.5, January 2026. The glass house was yours, @rauchg.

    Post summary

    The text lists two CVEs with brief vulnerability descriptions but provides no actionable details such as PoC, exploit code, or mitigation steps.

    0000059
    317 followersView on X
CPE platform detail83 entries

83 of 83 entries

PartVendorProductVersionTarget SWTarget HW
Appfacebookreact---
Appvercelnext.js-node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js15.6.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-
Appvercelnext.js16.1.0node.js-

Explore more

Back to dashboardfacebook CVEsvercel CVEsnext.js vulnerabilities