@vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components

HIGH 7.5GHSA-w94c-4vhp-22gx · Published 11/05/2026 · updated 11/05/2026

In short

GHSA-w94c-4vhp-22gx is a HIGH (CVSS 7.5) vulnerability affecting @vitejs/plugin-rsc.
Fix: update to 0.5.26 or later.

Package	Affected versions	Patched versions
@vitejs/plugin-rsc npm	`< 0.5.26`	`0.5.26`

@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.6. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh

Upgrade immediately to @vitejs/[email protected] or later.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

npm

< 0.5.26

0.5.26

Description

Upgrade immediately to @vitejs/[email protected] or later.

More vulnerabilities in @vitejs/plugin-rsc

See all →