---
title: "GHSA-fmh4-wr37-44fp: React Server Components are Vulnerable to RCE"
url: https://erroneo.us/security/ghsa/GHSA-fmh4-wr37-44fp/
description: "GHSA-fmh4-wr37-44fp (critical, npm): React Server Components are Vulnerable to RCE. Summary @vitejs/plugin-rsc vendors react-server-dom-webpack, which…"
type: advisory
section: "Security Digest"
date_published: 2025-12-03
date_modified: 2025-12-11
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-fmh4-wr37-44fp"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-fmh4-wr37-44fp: React Server Components are Vulnerable to RCE

## Affected packages

- npm `@vitejs/plugin-rsc` <= 0.5.2 → fixed: 0.5.3

## Details

Summary @vitejs/plugin-rsc vendors react-server-dom-webpack, which contained an unauthenticated remote code execution vulnerability in versions prior to 19.0.1, 19.1.2, and 19.2.1. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r Impact Applications using affected versions of @vitejs/plugin-rsc are vulnerable to unauthenticated remote code execution through deserialization of untrusted data. An attacker can execute arbitrary code remotely without authentication, affecting confidentiality, integrity, and availability. Recommendations Upgrade immediately to @vitejs/plugin-rsc@0.5.3 or later. Workarounds Applications not using server-side React or React Server Components are unaffected.

## Sources

- [GitHub Advisory GHSA-fmh4-wr37-44fp](https://github.com/advisories/GHSA-fmh4-wr37-44fp)
- [github.com](https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r)
- [github.com](https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-fmh4-wr37-44fp)
- [react.dev](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components)
- [github.com](https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp)

---
Source page: https://erroneo.us/security/ghsa/GHSA-fmh4-wr37-44fp/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt