@vitejs/plugin-rsc
0.5.38 · 15 Oct 2026MIT1.1M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @vitejs/plugin-rsc. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 0.5.38 | Safe from 0.5.26 | |
| 0.4.34 | 7 open advisories, worst critical · last release Oct 2025, no longer updated |
- Critical@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development serverGHSA-j76j-5p5g-9wfr · 8 Dec 2025
- 0.5.x0.5.0 – 0.5.5Fixed in 0.5.6
- 0.4.x0.4.10 – 0.4.34No fix on 0.4.x · move to 0.5.6
- CriticalReact Server Components are Vulnerable to RCEGHSA-fmh4-wr37-44fp · 3 Dec 2025
- 0.5.x0.5.0 – 0.5.2Fixed in 0.5.3
- 0.4.x0.4.10 – 0.4.34No fix on 0.4.x · move to 0.5.3
- High@vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server ComponentsGHSA-w94c-4vhp-22gx · 11 May 2026
- 0.5.x0.5.0 – 0.5.25Fixed in 0.5.26
- 0.4.x0.4.10 – 0.4.34No fix on 0.4.x · move to 0.5.26
- High@vitejs/plugin-rsc has a Denial of Service with React Server ComponentsGHSA-v457-wxvj-p9w9 · 10 Apr 2026
- 0.5.x0.5.0 – 0.5.22Fixed in 0.5.23
- 0.4.x0.4.10 – 0.4.34No fix on 0.4.x · move to 0.5.23
- High@vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` EndpointGHSA-g239-q96q-x4qm · 16 Dec 2025
- 0.5.x0.5.0 – 0.5.7Fixed in 0.5.8
- 0.4.x0.4.10 – 0.4.34No fix on 0.4.x · move to 0.5.8
- HighVite Plugin React has a Denial of Service Vulnerability in React Server ComponentsGHSA-cpqf-f22c-r95x · 12 Dec 2025
- 0.5.x0.5.0 – 0.5.6Fixed in 0.5.7
- 0.4.x0.4.10 – 0.4.34No fix on 0.4.x · move to 0.5.7
- ModerateVite Plugin React has a Source Code Exposure Vulnerability in React Server ComponentsGHSA-c6m7-q6pr-c64r · 12 Dec 2025
- 0.5.x0.5.0 – 0.5.6Fixed in 0.5.7
- 0.4.x0.4.10 – 0.4.34No fix on 0.4.x · move to 0.5.7
Registry facts last checked 22 Oct 2026. Releases and advisories last read 22 Oct 2026.