# 🔍 React RSC Vulnerability Scanner

A fast, zero-dependency Node.js CLI tool to scan your projects for React Server Components security vulnerabilities.

```bash
npx react-rsc-vuln-scanner /path/to/your/projects
```

![Node.js](https://img.shields.io/badge/Node.js-18+-339933?logo=node.js&logoColor=white)
![License](https://img.shields.io/badge/License-MIT-blue)
![CVE](https://img.shields.io/badge/CVE--2025--55182-CRITICAL-red)
![CVE](https://img.shields.io/badge/CVE--2025--55184-HIGH-orange)
![CVE](https://img.shields.io/badge/CVE--2025--55183-MEDIUM-yellow)
[![npm](https://img.shields.io/npm/v/react-rsc-vuln-scanner)](https://www.npmjs.com/package/react-rsc-vuln-scanner)

## 🚨 About the Vulnerabilities

This scanner checks for **three CVEs** affecting React Server Components:

| CVE | Severity | CVSS | Description | Disclosed |
|-----|----------|------|-------------|-----------|
| **CVE-2025-55182** | 🔴 CRITICAL | 10.0 | Remote Code Execution (React2Shell) | Dec 3, 2025 |
| **CVE-2025-55184** | 🟠 HIGH | 7.5 | Denial of Service | Dec 11, 2025 |
| **CVE-2025-55183** | 🟡 MEDIUM | 5.3 | Source Code Exposure | Dec 11, 2025 |

> ⚠️ **Important:** The patches for CVE-2025-55182 (versions 19.0.1, 19.1.2, 19.2.1) are vulnerable to the two new CVEs. You must upgrade to **19.0.2, 19.1.3, or 19.2.2** to be fully protected.

**Even if your app does not implement any React Server Function endpoints, it may still be vulnerable if it supports React Server Components.**

### Affected Packages

| Package | Vulnerable Versions | Fixed Versions |
|---------|---------------------|----------------|
| `react-server-dom-webpack` | 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, 19.2.1 | **19.0.2**, **19.1.3**, **19.2.2** |
| `react-server-dom-parcel` | 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, 19.2.1 | **19.0.2**, **19.1.3**, **19.2.2** |
| `react-server-dom-turbopack` | 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, 19.2.1 | **19.0.2**, **19.1.3**, **19.2.2** |

### Affected Frameworks

- **Next.js** — See patched versions below (Pages Router not affected)
- **React Router** — If using unstable RSC APIs
- **Waku**
- **@parcel/rsc**
- **@vitejs/plugin-rsc**
- **rwsdk** (Redwood SDK)

### Next.js Patched Versions

From [Vercel's Security Bulletin](https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183):

| Next.js Version | Fixed In |
|-----------------|----------|
| 13.x | Upgrade to **14.2.35** |
| 14.x | **14.2.35** |
| 15.0.x | **15.0.7** |
| 15.1.x | **15.1.11** |
| 15.2.x | **15.2.8** |
| 15.3.x | **15.3.8** |
| 15.4.x | **15.4.10** |
| 15.5.x | **15.5.9** |
| 16.0.x | **16.0.10** |

> **Note:** Next.js Pages Router applications are **not affected**. Only App Router with React Server Components is vulnerable.

## ✨ Features

- 🚀 **Zero dependencies** — Pure Node.js, no npm install required
- 📁 **Recursive scanning** — Scans all subdirectories for Node.js projects
- 🎯 **Direct & transitive detection** — Checks both direct dependencies and flags frameworks that may include vulnerable packages
- 🎨 **Beautiful CLI output** — Color-coded results with clear severity indicators
- ⚡ **Fast** — Skips `node_modules`, `.git`, `dist`, and other non-essential directories
- 📊 **Detailed reporting** — Lists all scanned projects and provides actionable upgrade instructions

## 🚀 Quick Start

**No installation required!** Run directly with npx:

```bash
npx react-rsc-vuln-scanner /path/to/your/projects
```

That's it! One command to scan all your projects.

## 📦 Alternative Installation

### Global Install (optional)

```bash
npm install -g react-rsc-vuln-scanner
react-rsc-vuln-scanner /path/to/projects
```

### Download Script Directly

```bash
# Clone the repository
git clone https://github.com/yourusername/react-rsc-vuln-scanner.git
node react-rsc-vuln-scanner/scan-react-rsc-vuln.js /path/to/projects

# Or just download the script
curl -O https://raw.githubusercontent.com/yourusername/react-rsc-vuln-scanner/main/scan-react-rsc-vuln.js
node scan-react-rsc-vuln.js /path/to/projects
```

## 📖 Usage Examples

Scan your entire projects directory:

```bash
npx react-rsc-vuln-scanner /Users/username/projects
```

Scan a specific project:

```bash
npx react-rsc-vuln-scanner /Users/username/projects/my-nextjs-app
```

Show help:

```bash
npx react-rsc-vuln-scanner --help
```

## 📸 Sample Output

```
══════════════════════════════════════════════════════════════════════
  React Server Components Vulnerability Scanner
══════════════════════════════════════════════════════════════════════
  Checking for 3 CVEs:
  • CVE-2025-55182 - RCE (CRITICAL, CVSS 10.0)
  • CVE-2025-55184 - Denial of Service (HIGH, CVSS 7.5)
  • CVE-2025-55183 - Source Code Exposure (MEDIUM, CVSS 5.3)
──────────────────────────────────────────────────────────────────────
  References:
  https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
  https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

🔍 Scanning for package.json files...

📂 Scan Directory: /Users/username/projects
📊 Total Projects Scanned: 15

──────────────────────────────────────────────────────────────────────
📋 All Scanned Projects:
──────────────────────────────────────────────────────────────────────
   • my-nextjs-app
   • react-dashboard
   • api-server
   ...

──────────────────────────────────────────────────────────────────────
🚨 VULNERABLE PACKAGES FOUND:
──────────────────────────────────────────────────────────────────────

   📁 my-nextjs-app
      Path: /Users/username/projects/my-nextjs-app
      • react-server-dom-webpack@19.1.0 [VULNERABLE]
        ⚠️  CVE-2025-55182: Remote Code Execution (React2Shell) (CRITICAL, CVSS 10.0)
        ⚠️  CVE-2025-55184: Denial of Service (HIGH, CVSS 7.5)
        ⚠️  CVE-2025-55183: Source Code Exposure (MEDIUM, CVSS 5.3)
        🔧 Upgrade to: 19.0.2 or 19.1.3 or 19.2.2

──────────────────────────────────────────────────────────────────────
⚠️  PROJECTS WITH POTENTIALLY AFFECTED FRAMEWORKS:
──────────────────────────────────────────────────────────────────────

   📁 react-dashboard
      Path: /Users/username/projects/react-dashboard
      • next@15.3.1
        Next.js - check if using RSC features
        Check fixed versions for your release line

══════════════════════════════════════════════════════════════════════
📈 SUMMARY
══════════════════════════════════════════════════════════════════════
   Total projects scanned: 15
   Projects with vulnerable packages: 1
   Projects with affected frameworks: 2

⚠️  ACTION REQUIRED:
   1. Update vulnerable packages immediately to 19.0.2, 19.1.3, or 19.2.2
   2. Check node_modules for transitive dependencies
   3. Run `npm ls react-server-dom-webpack` to check nested deps
   4. References:
      - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
      - https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
```

## 🔧 How It Works

1. Recursively finds all `package.json` files in the target directory
2. Skips common non-essential directories (`node_modules`, `.git`, `dist`, `build`, `.next`, `.cache`, `coverage`)
3. Parses each `package.json` and checks `dependencies`, `devDependencies`, and `peerDependencies`
4. Identifies directly vulnerable packages with exact version matching
5. Flags projects using frameworks that may include vulnerable packages as transitive dependencies
6. Outputs a comprehensive report with actionable remediation steps

## ⚠️ Important Notes

- This tool checks `package.json` files for **declared dependencies**
- For complete security, also check your `node_modules` for **transitive dependencies**:
  ```bash
  npm ls react-server-dom-webpack
  npm ls react-server-dom-parcel
  npm ls react-server-dom-turbopack
  ```
- If your app's React code does not use a server, your app is **not affected**
- If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is **not affected**

## 🛡️ Remediation

### Direct React RSC Packages

Upgrade to the latest patched versions (**19.0.2**, **19.1.3**, or **19.2.2**):

```bash
# For 19.0.x line
npm install react-server-dom-webpack@19.0.2
npm install react-server-dom-parcel@19.0.2
npm install react-server-dom-turbopack@19.0.2

# For 19.1.x line
npm install react-server-dom-webpack@19.1.3
npm install react-server-dom-parcel@19.1.3
npm install react-server-dom-turbopack@19.1.3

# For 19.2.x line (recommended)
npm install react-server-dom-webpack@19.2.2
npm install react-server-dom-parcel@19.2.2
npm install react-server-dom-turbopack@19.2.2
```

### Next.js

Update to the patched version for your release line (from [Vercel's Security Bulletin](https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183)):

```bash
npm install next@14.2.35  # for 13.x and 14.x
npm install next@15.0.7   # for 15.0.x
npm install next@15.1.11  # for 15.1.x
npm install next@15.2.8   # for 15.2.x
npm install next@15.3.8   # for 15.3.x
npm install next@15.4.10  # for 15.4.x
npm install next@15.5.9   # for 15.5.x
npm install next@16.0.10  # for 16.0.x
```

Or use Vercel's automated fix tool:

```bash
npx fix-react2shell-next
```

## 🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

1. Fork the repository
2. Create your feature branch (`git checkout -b feature/amazing-feature`)
3. Commit your changes (`git commit -m 'Add some amazing feature'`)
4. Push to the branch (`git push origin feature/amazing-feature`)
5. Open a Pull Request

## 📄 License

This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.

## 🔗 References

- [React Security Advisory - RCE (Dec 3, 2025)](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components)
- [React Security Advisory - DoS & Source Code Exposure (Dec 11, 2025)](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components)
- [Vercel Security Bulletin - CVE-2025-55184 & CVE-2025-55183](https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183)
- [CVE-2025-55182](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55182) - Remote Code Execution (CRITICAL)
- [CVE-2025-55184](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55184) - Denial of Service (HIGH)
- [CVE-2025-55183](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55183) - Source Code Exposure (MEDIUM)

## 💖 Acknowledgments

- Thanks to Lachlan Davidson for discovering and responsibly disclosing CVE-2025-55182
- Thanks to Andrew MacPherson (AndrewMohawk) for reporting the Source Code Exposure (CVE-2025-55183)
- Thanks to RyotaK from GMO Flatt Security Inc for reporting the Denial of Service vulnerability (CVE-2025-55184)
- The React team for the rapid response and fixes

---

**⚠️ Disclaimer:** This tool is provided as-is for informational purposes. Always verify findings manually and follow official remediation guidance from the React team and your framework maintainers.