GHSA-v457-wxvj-p9w9: @vitejs/plugin-rsc has a Denial of Service with React Server Components

April 10, 2026

@vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.4. See details in React repository’s advisory https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg

References

github.com/advisories/GHSA-v457-wxvj-p9w9
github.com/vitejs/vite-plugin-react
github.com/vitejs/vite-plugin-react/security/advisories/GHSA-v457-wxvj-p9w9

Code Behaviors & Features

Detect and mitigate GHSA-v457-wxvj-p9w9 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →