ID:12189 - Exploit for Information disclosure in React - CVE-2025-55183

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the server may expose the source code of any server function when receiving a specially crafted HTTP request. A remote attacker can gain access to sensitive information.

The vulnerability affects the following components:

- react-server-dom-webpack (Meta) 
- react-server-dom-turbopack (Meta) 
- react-server-dom-parcel (Meta) 

Successful exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

Remediation