react-rsc-vuln-scanner

v1.3.0

Published

8 days ago

CLI tool to scan projects for React Server Components vulnerabilities (CVE-2025-55182, CVE-2025-55184, CVE-2025-55183)

0High
0Medium
0Low

react security vulnerability scanner cve cve-2025-55182 cve-2025-55183 cve-2025-55184 rsc react-server-components nextjs audit dos rce

🔍 React RSC Vulnerability Scanner

A fast, zero-dependency Node.js CLI tool to scan your projects for React Server Components security vulnerabilities.

npx react-rsc-vuln-scanner /path/to/your/projects

🚨 About the Vulnerabilities

This scanner checks for three CVEs affecting React Server Components:

| CVE | Severity | CVSS | Description | Disclosed | |-----|----------|------|-------------|-----------| | CVE-2025-55182 | 🔴 CRITICAL | 10.0 | Remote Code Execution (React2Shell) | Dec 3, 2025 | | CVE-2025-55184 | 🟠 HIGH | 7.5 | Denial of Service | Dec 11, 2025 | | CVE-2025-55183 | 🟡 MEDIUM | 5.3 | Source Code Exposure | Dec 11, 2025 |

⚠️ Important: The patches for CVE-2025-55182 (versions 19.0.1, 19.1.2, 19.2.1) are vulnerable to the two new CVEs. You must upgrade to 19.0.2, 19.1.3, or 19.2.2 to be fully protected.

Even if your app does not implement any React Server Function endpoints, it may still be vulnerable if it supports React Server Components.

Affected Packages

| Package | Vulnerable Versions | Fixed Versions | |---------|---------------------|----------------| | react-server-dom-webpack | 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, 19.2.1 | 19.0.2, 19.1.3, 19.2.2 | | react-server-dom-parcel | 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, 19.2.1 | 19.0.2, 19.1.3, 19.2.2 | | react-server-dom-turbopack | 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, 19.2.1 | 19.0.2, 19.1.3, 19.2.2 |

Affected Frameworks

Next.js — See patched versions below (Pages Router not affected)
React Router — If using unstable RSC APIs
Waku
@parcel/rsc
@vitejs/plugin-rsc
rwsdk (Redwood SDK)

Next.js Patched Versions

From Vercel's Security Bulletin:

| Next.js Version | Fixed In | |-----------------|----------| | 13.x | Upgrade to 14.2.35 | | 14.x | 14.2.35 | | 15.0.x | 15.0.7 | | 15.1.x | 15.1.11 | | 15.2.x | 15.2.8 | | 15.3.x | 15.3.8 | | 15.4.x | 15.4.10 | | 15.5.x | 15.5.9 | | 16.0.x | 16.0.10 |

Note: Next.js Pages Router applications are not affected. Only App Router with React Server Components is vulnerable.

✨ Features

🚀 Zero dependencies — Pure Node.js, no npm install required
📁 Recursive scanning — Scans all subdirectories for Node.js projects
🎯 Direct & transitive detection — Checks both direct dependencies and flags frameworks that may include vulnerable packages
🎨 Beautiful CLI output — Color-coded results with clear severity indicators
⚡ Fast — Skips node_modules, .git, dist, and other non-essential directories
📊 Detailed reporting — Lists all scanned projects and provides actionable upgrade instructions

🚀 Quick Start

No installation required! Run directly with npx:

npx react-rsc-vuln-scanner /path/to/your/projects

That's it! One command to scan all your projects.

📦 Alternative Installation

Global Install (optional)

npm install -g react-rsc-vuln-scanner
react-rsc-vuln-scanner /path/to/projects

Download Script Directly

# Clone the repository
git clone https://github.com/yourusername/react-rsc-vuln-scanner.git
node react-rsc-vuln-scanner/scan-react-rsc-vuln.js /path/to/projects

# Or just download the script
curl -O https://raw.githubusercontent.com/yourusername/react-rsc-vuln-scanner/main/scan-react-rsc-vuln.js
node scan-react-rsc-vuln.js /path/to/projects

📖 Usage Examples

Scan your entire projects directory:

npx react-rsc-vuln-scanner /Users/username/projects

Scan a specific project:

npx react-rsc-vuln-scanner /Users/username/projects/my-nextjs-app

Show help:

npx react-rsc-vuln-scanner --help

📸 Sample Output

══════════════════════════════════════════════════════════════════════
  React Server Components Vulnerability Scanner
══════════════════════════════════════════════════════════════════════
  Checking for 3 CVEs:
  • CVE-2025-55182 - RCE (CRITICAL, CVSS 10.0)
  • CVE-2025-55184 - Denial of Service (HIGH, CVSS 7.5)
  • CVE-2025-55183 - Source Code Exposure (MEDIUM, CVSS 5.3)
──────────────────────────────────────────────────────────────────────
  References:
  https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
  https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

🔍 Scanning for package.json files...

📂 Scan Directory: /Users/username/projects
📊 Total Projects Scanned: 15

──────────────────────────────────────────────────────────────────────
📋 All Scanned Projects:
──────────────────────────────────────────────────────────────────────
   • my-nextjs-app
   • react-dashboard
   • api-server
   ...

──────────────────────────────────────────────────────────────────────
🚨 VULNERABLE PACKAGES FOUND:
──────────────────────────────────────────────────────────────────────

   📁 my-nextjs-app
      Path: /Users/username/projects/my-nextjs-app
      • [email protected] [VULNERABLE]
        ⚠️  CVE-2025-55182: Remote Code Execution (React2Shell) (CRITICAL, CVSS 10.0)
        ⚠️  CVE-2025-55184: Denial of Service (HIGH, CVSS 7.5)
        ⚠️  CVE-2025-55183: Source Code Exposure (MEDIUM, CVSS 5.3)
        🔧 Upgrade to: 19.0.2 or 19.1.3 or 19.2.2

──────────────────────────────────────────────────────────────────────
⚠️  PROJECTS WITH POTENTIALLY AFFECTED FRAMEWORKS:
──────────────────────────────────────────────────────────────────────

   📁 react-dashboard
      Path: /Users/username/projects/react-dashboard
      • [email protected]
        Next.js - check if using RSC features
        Check fixed versions for your release line

══════════════════════════════════════════════════════════════════════
📈 SUMMARY
══════════════════════════════════════════════════════════════════════
   Total projects scanned: 15
   Projects with vulnerable packages: 1
   Projects with affected frameworks: 2

⚠️  ACTION REQUIRED:
   1. Update vulnerable packages immediately to 19.0.2, 19.1.3, or 19.2.2
   2. Check node_modules for transitive dependencies
   3. Run `npm ls react-server-dom-webpack` to check nested deps
   4. References:
      - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
      - https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

🔧 How It Works

Recursively finds all package.json files in the target directory
Skips common non-essential directories (node_modules, .git, dist, build, .next, .cache, coverage)
Parses each package.json and checks dependencies, devDependencies, and peerDependencies
Identifies directly vulnerable packages with exact version matching
Flags projects using frameworks that may include vulnerable packages as transitive dependencies
Outputs a comprehensive report with actionable remediation steps

⚠️ Important Notes

This tool checks package.json files for declared dependencies

For complete security, also check your node_modules for transitive dependencies:

npm ls react-server-dom-webpack
npm ls react-server-dom-parcel
npm ls react-server-dom-turbopack

If your app's React code does not use a server, your app is not affected
If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected

🛡️ Remediation

Direct React RSC Packages

Upgrade to the latest patched versions (19.0.2, 19.1.3, or 19.2.2):

# For 19.0.x line
npm install [email protected]
npm install [email protected]
npm install [email protected]

# For 19.1.x line
npm install [email protected]
npm install [email protected]
npm install [email protected]

# For 19.2.x line (recommended)
npm install [email protected]
npm install [email protected]
npm install [email protected]

Next.js

Update to the patched version for your release line (from Vercel's Security Bulletin):

npm install [email protected]  # for 13.x and 14.x
npm install [email protected]   # for 15.0.x
npm install [email protected]  # for 15.1.x
npm install [email protected]   # for 15.2.x
npm install [email protected]   # for 15.3.x
npm install [email protected]  # for 15.4.x
npm install [email protected]   # for 15.5.x
npm install [email protected]  # for 16.0.x

Or use Vercel's automated fix tool:

npx fix-react2shell-next

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

Fork the repository
Create your feature branch (git checkout -b feature/amazing-feature)
Commit your changes (git commit -m 'Add some amazing feature')
Push to the branch (git push origin feature/amazing-feature)
Open a Pull Request

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🔗 References

React Security Advisory - RCE (Dec 3, 2025)
React Security Advisory - DoS & Source Code Exposure (Dec 11, 2025)
Vercel Security Bulletin - CVE-2025-55184 & CVE-2025-55183
CVE-2025-55182 - Remote Code Execution (CRITICAL)
CVE-2025-55184 - Denial of Service (HIGH)
CVE-2025-55183 - Source Code Exposure (MEDIUM)

💖 Acknowledgments

Thanks to Lachlan Davidson for discovering and responsibly disclosing CVE-2025-55182
Thanks to Andrew MacPherson (AndrewMohawk) for reporting the Source Code Exposure (CVE-2025-55183)
Thanks to RyotaK from GMO Flatt Security Inc for reporting the Denial of Service vulnerability (CVE-2025-55184)
The React team for the rapid response and fixes

⚠️ Disclaimer: This tool is provided as-is for informational purposes. Always verify findings manually and follow official remediation guidance from the React team and your framework maintainers.