Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components

MEDIUM 5.3GHSA-c6m7-q6pr-c64r · Published 12/12/2025 · updated 12/12/2025

In short

GHSA-c6m7-q6pr-c64r is a MEDIUM (CVSS 5.3) vulnerability affecting @vitejs/plugin-rsc.
Fix: update to 0.5.7 or later.

Package	Affected versions	Patched versions
@vitejs/plugin-rsc npm	`< 0.5.7`	`0.5.7`

@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.3. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4

Upgrade immediately to @vitejs/[email protected] or later.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

npm

< 0.5.7

0.5.7

Description

Upgrade immediately to @vitejs/[email protected] or later.

More vulnerabilities in @vitejs/plugin-rsc

See all →