Passive GET check · OSV.dev
React Server Components advisories
Detects whether an origin ships RSC and which React version, then queries OSV.dev. No version list is hard-coded here.
How this check works
React Server Components have had several advisories since December 2025, starting with CVE-2025-55182 (critical RCE). Rather than track a list of affected versions here, this tool detects the React version an origin ships and queries OSV.dev for advisories against the react-server-dom-* packages at that version.
“No known advisories” means OSV.dev returned nothing for the detected version — it is not a guarantee. Keep dependencies patched.
Point-in-time check. Prefer the main scan for a full scorecard.