Packages / @vitejs/plugin-rsc / Security

CriticalVulnerabilityGHSA-fmh4-wr37-44fpPublished 3 Dec 2025

React Server Components are Vulnerable to RCE

Affected releases · @vitejs/plugin-rsc

  • 0.5.x0.5.0 – 0.5.2Fixed in 0.5.3
  • 0.4.x0.4.10 – 0.4.34No fix on this line yet

On 0.5.x, the newest line:

npm install @vitejs/plugin-rsc@0.5.3

  1. Affected

    0.4.10 – 0.5.2

    28 releases

  2. Fixed

    0.5.3 – 0.5.38

    36 releases, latest

64 stable releases of @vitejs/plugin-rsc, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for @vitejs/plugin-rsc. It is read in your browser and sent nowhere.

What happens

Summary

@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained an unauthenticated remote code execution vulnerability in versions prior to 19.0.1, 19.1.2, and 19.2.1. See details in React repository's advisory github.com/facebook/react/security/advisories/G…

Impact

Applications using affected versions of @vitejs/plugin-rsc are vulnerable to unauthenticated remote code execution through deserialization of untrusted data. An attacker can execute arbitrary code remotely without authentication, affecting confidentiality, integrity, and availability.

Recommendations

Upgrade immediately to @vitejs/plugin-rsc@0.5.3 or later.

Workarounds

Applications not using server-side React or React Server Components are unaffected.