High severity · published Dec 11, 2025
CVE-2025-55184
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following…
7.5
CVSS
66.6%
EPSS
No
On KEV
Description
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)66.6% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
react-server-dom-parcel · Meta
19.0.0 through 19.0.1; 19.1.0 through 19.1.2; 19.2.0 through 19.2.1 · source: vendor
RE
react-server-dom-turbopack · Meta
19.0.0 through 19.0.1; 19.1.0 through 19.1.2; 19.2.0 through 19.2.1 · source: vendor
RE
react-server-dom-webpack · Meta
19.0.0 through 19.0.1; 19.1.0 through 19.1.2; 19.2.0 through 19.2.1 · source: vendor
NE
Next.js · Vercel
13.3.0 before 14.2.35; 15.0.0 before 15.0.7; 15.1.0 before 15.1.11; 15.2.0 before 15.2.8; 15.3.0 before 15.3.8; 15.4.0 before 15.4.10; +34 more · source: NVD
RE
React · Facebook
19.0.0 before 19.0.2; 19.1.0 before 19.1.3; 19.2.0 before 19.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55184
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55184
Vendor Advisory
https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
Vendor Advisory
https://www.facebook.com/security/advisories/cve-2025-55184
github.com
https://github.com/KingHacker353/CVE-2025-55184
More from react-server-dom-parcel
10.0
CVE-2025-55182
Meta React Server Components Remote Code Execution Vulnerability
7.5
CVE-2026-44907
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the…
7.5
CVE-2026-23870
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory…
7.5
CVE-2026-23869
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and…
7.5
CVE-2026-23864
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack,…