React Server Components CVE-2025-55183

Upgrade React Server Components and the consuming framework to a fixed release; the exact fixed version numbers are not enumerated in the supplied intelligence, so obtain them from the vendor advisory at https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components, which groups this source-exposure issue with a related denial-of-service flaw, and from https://www.facebook.com/security/advisories/cve-2025-55183 - patch status beyond advisory guidance is not independently confirmed by the provided data, so verify against the maintainers rather than assuming a given build is fixed. Where immediate upgrade of Next.js or the react-server-dom-* package is not possible, reduce exposure by removing or refactoring Server Functions that pass stringified arguments across the client-server boundary, for example values produced by JSON.stringify or otherwise pre-serialized; this is the deployment-specific prerequisite for exploitation, so applications with no argument-exposing Server Function are not exploitable even while running a vulnerable version, and refactoring them eliminates the attack path at the cost of reworking component interfaces. Additional compensating controls with their trade-offs are to place a WAF or reverse proxy in front of the application with rules that normalize or block crafted requests against Server Function endpoints, accepting false positives and ongoing tuning because legitimate Flight payloads share the same routes, and to restrict network access to RSC/Flight endpoints to trusted clients where the architecture permits. Because the disclosed material is source code, monitor logs for RSC endpoint responses containing unexpected source content and rotate any secrets, internal URLs or API keys embedded in exposed Server Functions once disclosure is suspected, treating the leak as reconnaissance that can enable follow-on attacks.