Packages / @vitejs/plugin-rsc / Security

HighVulnerabilityGHSA-v457-wxvj-p9w9Published 10 Apr 2026

@vitejs/plugin-rsc has a Denial of Service with React Server Components

Affected releases · @vitejs/plugin-rsc

  • 0.5.x0.5.0 – 0.5.22Fixed in 0.5.23
  • 0.4.x0.4.10 – 0.4.34No fix on this line yet

On 0.5.x, the newest line:

npm install @vitejs/plugin-rsc@0.5.23

  1. Affected

    0.4.10 – 0.5.22

    48 releases

  2. Fixed

    0.5.23 – 0.5.38

    16 releases, latest

64 stable releases of @vitejs/plugin-rsc, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for @vitejs/plugin-rsc. It is read in your browser and sent nowhere.

What happens

Impact

@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.4. See details in React repository's advisory github.com/facebook/react/security/advisories/G…

Patches

Upgrade immediately to @vitejs/plugin-rsc@0.5.23 or later.