CVE-2025-67779: It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case

High severity · published Dec 12, 2025

CVE-2025-67779

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case

7.5

CVSS

20%

EPSS

On KEV

Description

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)20.0% · higher than 97% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Next.js · Vercel

13.3.0 before 14.2.35; 15.0.0 before 15.0.7; 15.1.0 before 15.1.11; 15.2.0 before 15.2.8; 15.3.0 before 15.3.8; 15.4.0 before 15.4.10; +34 more · source: NVD

React · Facebook

19.0.2; 19.1.3; 19.2.2 · source: NVD

Affected product

React

Facebook

All React CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-67779

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-67779

Vendor Advisory

https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

Vendor Advisory

https://www.facebook.com/security/advisories/cve-2025-67779