GET

Package Instance

Lookup for vulnerable packages by Package URL.

GET /api/packages/72919?format=api
HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/72919?format=api",
    "purl": "pkg:npm/react-server-dom-webpack@19.1.3",
    "type": "npm",
    "namespace": "",
    "name": "react-server-dom-webpack",
    "version": "19.1.3",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": true,
    "next_non_vulnerable_version": "19.1.4",
    "latest_non_vulnerable_version": "19.2.6",
    "affected_by_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49428?format=api",
            "vulnerability_id": "VCID-fyz5-x6zm-efg5",
            "summary": "Denial of Service Vulnerability in React Server Components\nIt was found that the fix to address [CVE-2025-55184](https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and does not prevent a denial of service attack in a specific case.\n\nWe recommend updating immediately.\n\nThe vulnerability exists in versions 19.0.2, 19.1.3, and 19.2.2 of:\n\n- [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)\n- [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)\n- [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)\n\nThese issues are present in the patches published on December 11th, 2025.",
            "references": [
                {
                    "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-67779.json",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.5",
                            "scoring_system": "cvssv3",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                        }
                    ],
                    "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-67779.json"
                },
                {
                    "reference_url": "https://github.com/facebook/react",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.5",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                        },
                        {
                            "value": "HIGH",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://github.com/facebook/react"
                },
                {
                    "reference_url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.5",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                        },
                        {
                            "value": "HIGH",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"
                },
                {
                    "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421678",
                    "reference_id": "2421678",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421678"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67779",
                    "reference_id": "CVE-2025-67779",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.5",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                        },
                        {
                            "value": "HIGH",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67779"
                },
                {
                    "reference_url": "https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956",
                    "reference_id": "GHSA-2m3v-v2m8-q956",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.5",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                        },
                        {
                            "value": "HIGH",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-7gmr-mq3h-m5h9",
                    "reference_id": "GHSA-7gmr-mq3h-m5h9",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-7gmr-mq3h-m5h9"
                },
                {
                    "reference_url": "https://github.com/facebook/react/security/advisories/GHSA-7gmr-mq3h-m5h9",
                    "reference_id": "GHSA-7gmr-mq3h-m5h9",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.5",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                        },
                        {
                            "value": "HIGH",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://github.com/facebook/react/security/advisories/GHSA-7gmr-mq3h-m5h9"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/72960?format=api",
                    "purl": "pkg:npm/react-server-dom-webpack@19.1.4",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/react-server-dom-webpack@19.1.4"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/72961?format=api",
                    "purl": "pkg:npm/react-server-dom-webpack@19.2.3",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/react-server-dom-webpack@19.2.3"
                }
            ],
            "aliases": [
                "CVE-2025-67779",
                "GHSA-7gmr-mq3h-m5h9"
            ],
            "risk_score": 4.0,
            "exploitability": "0.5",
            "weighted_severity": "8.0",
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fyz5-x6zm-efg5"
        }
    ],
    "fixing_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49412?format=api",
            "vulnerability_id": "VCID-a9qu-qnde-t7f3",
            "summary": "Source Code Exposure Vulnerability in React Server Components\nThere is a source code exposure vulnerability in React Server Components.\n\nReact recommends updating immediately.\n\nThe vulnerability exists in versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of:\n\n- [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)\n- [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)\n- [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)\n\nThese issues are present in the patches published last week.",
            "references": [
                {
                    "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55183.json",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "5.3",
                            "scoring_system": "cvssv3",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
                        }
                    ],
                    "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55183.json"
                },
                {
                    "reference_url": "https://github.com/facebook/react",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "5.3",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
                        },
                        {
                            "value": "MODERATE",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://github.com/facebook/react"
                },
                {
                    "reference_url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "5.3",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
                        },
                        {
                            "value": "MODERATE",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"
                },
                {
                    "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421590",
                    "reference_id": "2421590",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421590"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55183",
                    "reference_id": "CVE-2025-55183",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "5.3",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
                        },
                        {
                            "value": "MODERATE",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55183"
                },
                {
                    "reference_url": "https://www.facebook.com/security/advisories/cve-2025-55183",
                    "reference_id": "CVE-2025-55183",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "5.3",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
                        },
                        {
                            "value": "MODERATE",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://www.facebook.com/security/advisories/cve-2025-55183"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-925w-6v3x-g4j4",
                    "reference_id": "GHSA-925w-6v3x-g4j4",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-925w-6v3x-g4j4"
                },
                {
                    "reference_url": "https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4",
                    "reference_id": "GHSA-925w-6v3x-g4j4",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "5.3",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
                        },
                        {
                            "value": "MODERATE",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://github.com/facebook/react/security/advisories/GHSA-925w-6v3x-g4j4"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/72918?format=api",
                    "purl": "pkg:npm/react-server-dom-webpack@19.0.2",
                    "is_vulnerable": true,
                    "affected_by_vulnerabilities": [
                        {
                            "vulnerability": "VCID-fyz5-x6zm-efg5"
                        }
                    ],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/react-server-dom-webpack@19.0.2"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/72919?format=api",
                    "purl": "pkg:npm/react-server-dom-webpack@19.1.3",
                    "is_vulnerable": true,
                    "affected_by_vulnerabilities": [
                        {
                            "vulnerability": "VCID-fyz5-x6zm-efg5"
                        }
                    ],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/react-server-dom-webpack@19.1.3"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/72920?format=api",
                    "purl": "pkg:npm/react-server-dom-webpack@19.2.2",
                    "is_vulnerable": true,
                    "affected_by_vulnerabilities": [
                        {
                            "vulnerability": "VCID-fyz5-x6zm-efg5"
                        }
                    ],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/react-server-dom-webpack@19.2.2"
                }
            ],
            "aliases": [
                "CVE-2025-55183",
                "GHSA-925w-6v3x-g4j4"
            ],
            "risk_score": 3.1,
            "exploitability": "0.5",
            "weighted_severity": "6.2",
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a9qu-qnde-t7f3"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49413?format=api",
            "vulnerability_id": "VCID-hc9w-hrbq-93c5",
            "summary": "Denial of Service Vulnerability in React Server Components\nThere is a denial of service vulnerability in React Server Components.\n\nReact recommends updating immediately.\n\nThe vulnerability exists in versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of:\n\n- [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)\n- [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)\n- [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)\n\nThese issues are present in the patches published last week.",
            "references": [
                {
                    "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55184.json",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.5",
                            "scoring_system": "cvssv3",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                        }
                    ],
                    "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55184.json"
                },
                {
                    "reference_url": "https://github.com/facebook/react",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.5",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                        },
                        {
                            "value": "HIGH",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://github.com/facebook/react"
                },
                {
                    "reference_url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.5",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                        },
                        {
                            "value": "HIGH",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"
                },
                {
                    "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421588",
                    "reference_id": "2421588",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421588"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55184",
                    "reference_id": "CVE-2025-55184",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.5",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                        },
                        {
                            "value": "HIGH",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55184"
                },
                {
                    "reference_url": "https://www.facebook.com/security/advisories/cve-2025-55184",
                    "reference_id": "CVE-2025-55184",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.5",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                        },
                        {
                            "value": "HIGH",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://www.facebook.com/security/advisories/cve-2025-55184"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-2m3v-v2m8-q956",
                    "reference_id": "GHSA-2m3v-v2m8-q956",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-2m3v-v2m8-q956"
                },
                {
                    "reference_url": "https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956",
                    "reference_id": "GHSA-2m3v-v2m8-q956",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.5",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                        },
                        {
                            "value": "HIGH",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/72918?format=api",
                    "purl": "pkg:npm/react-server-dom-webpack@19.0.2",
                    "is_vulnerable": true,
                    "affected_by_vulnerabilities": [
                        {
                            "vulnerability": "VCID-fyz5-x6zm-efg5"
                        }
                    ],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/react-server-dom-webpack@19.0.2"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/72919?format=api",
                    "purl": "pkg:npm/react-server-dom-webpack@19.1.3",
                    "is_vulnerable": true,
                    "affected_by_vulnerabilities": [
                        {
                            "vulnerability": "VCID-fyz5-x6zm-efg5"
                        }
                    ],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/react-server-dom-webpack@19.1.3"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/72920?format=api",
                    "purl": "pkg:npm/react-server-dom-webpack@19.2.2",
                    "is_vulnerable": true,
                    "affected_by_vulnerabilities": [
                        {
                            "vulnerability": "VCID-fyz5-x6zm-efg5"
                        }
                    ],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/react-server-dom-webpack@19.2.2"
                }
            ],
            "aliases": [
                "CVE-2025-55184",
                "GHSA-2m3v-v2m8-q956"
            ],
            "risk_score": 4.0,
            "exploitability": "0.5",
            "weighted_severity": "8.0",
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hc9w-hrbq-93c5"
        }
    ],
    "risk_score": "4.0",
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/react-server-dom-webpack@19.1.3"
}