Packages / @vitejs/plugin-rsc / Security

HighVulnerabilityGHSA-cpqf-f22c-r95xPublished 12 Dec 2025

Vite Plugin React has a Denial of Service Vulnerability in React Server Components

Affected releases · @vitejs/plugin-rsc

  • 0.5.x0.5.0 – 0.5.6Fixed in 0.5.7
  • 0.4.x0.4.10 – 0.4.34No fix on this line yet

On 0.5.x, the newest line:

npm install @vitejs/plugin-rsc@0.5.7

  1. Affected

    0.4.10 – 0.5.6

    32 releases

  2. Fixed

    0.5.7 – 0.5.38

    32 releases, latest

64 stable releases of @vitejs/plugin-rsc, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for @vitejs/plugin-rsc. It is read in your browser and sent nowhere.

What happens

Impact

@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.3. See details in React repository's advisory github.com/facebook/react/security/advisories/G…

Patches

Upgrade immediately to @vitejs/plugin-rsc@0.5.7 or later.