Two new RSC protocol vulnerabilities uncovered

Note: Some patched versions are still being released to npm. If a version listed below is not yet available, please check back shortly.

Two additional vulnerabilities have been identified in the React Server Components (RSC) protocol. These issues were discovered while security researchers examined the patches for React2Shell . Importantly, neither of these new issues allow for Remote Code Execution. The patch for React2Shell remains fully effective.

These vulnerabilities originate in the upstream React implementation ( CVE-2025-55183 , CVE-2025-55184 ). This advisory tracks the downstream impact on .js applications using the App Router. For full details, see the React blog post .

A specifically crafted HTTP request can be sent to any App Router endpoint that, when deserialized, can cause an infinite loop that hangs the server process and prevents future HTTP requests from being served.

A specifically crafted HTTP request can cause a Server Function to return the compiled source code of other Server Functions in your application. This could reveal business logic. Secrets could also be exposed if they are defined directly in your code (rather than accessed via environment variables at runtime) and referenced within a Server Function. Depending on your bundler configuration, these values may be inlined into the compiled function output.

Applications using React Server Components with the App Router are affected. The table below shows which versions are affected by each vulnerability and the corresponding fix:

Pages Router applications are not affected, but we still recommend upgrading to a patched version.

All users should upgrade to the latest patched version in their release line:

If you are on .js >=13.3, 14.0.x, or 14.1.x, upgrade to the latest 14.2.x release.

There is no workaround. Upgrading to a patched version is required.

Thank you to RyotaK from GMO Flatt Security Inc. and Andrew MacPherson for discovering and responsibly disclosing these vulnerabilities. We are intentionally limiting technical detail in this advisory to protect developers who have not yet upgraded.