Packages / @vitejs/plugin-rsc / Security

HighVulnerabilityGHSA-w94c-4vhp-22gxPublished 11 May 2026

@vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components

Affected releases · @vitejs/plugin-rsc

  • 0.5.x0.5.0 – 0.5.25Fixed in 0.5.26
  • 0.4.x0.4.10 – 0.4.34No fix on this line yet

On 0.5.x, the newest line:

npm install @vitejs/plugin-rsc@0.5.26

  1. Affected

    0.4.10 – 0.5.25

    51 releases

  2. Fixed

    0.5.26 – 0.5.38

    13 releases, latest

64 stable releases of @vitejs/plugin-rsc, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for @vitejs/plugin-rsc. It is read in your browser and sent nowhere.

What happens

Impact

@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.6. See details in React repository's advisory github.com/facebook/react/security/advisories/G…

Patches

Upgrade immediately to @vitejs/plugin-rsc@0.5.26 or later.