High severity · published Dec 11, 2025
CVE-2025-67779
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case
7.5
CVSS
20%
EPSS
No
On KEV
Description
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)20.0% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
react-server-dom-parcel · Meta
19.0.2 through 19.0.2; 19.1.3 through 19.1.3; 19.2.2 through 19.2.2 · source: vendor
RE
react-server-dom-turbopack · Meta
19.0.2 through 19.0.2; 19.1.3 through 19.1.3; 19.2.2 through 19.2.2 · source: vendor
RE
react-server-dom-webpack · Meta
19.0.2 through 19.0.2; 19.1.3 through 19.1.3; 19.2.2 through 19.2.2 · source: vendor
NE
Next.js · Vercel
13.3.0 before 14.2.35; 15.0.0 before 15.0.7; 15.1.0 before 15.1.11; 15.2.0 before 15.2.8; 15.3.0 before 15.3.8; 15.4.0 before 15.4.10; +34 more · source: NVD
RE
React · Facebook
19.0.2; 19.1.3; 19.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-67779
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-67779
Vendor Advisory
https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
Vendor Advisory
https://www.facebook.com/security/advisories/cve-2025-67779
More from react-server-dom-parcel
10.0
CVE-2025-55182
Meta React Server Components Remote Code Execution Vulnerability
7.5
CVE-2026-44907
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the…
7.5
CVE-2026-23870
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory…
7.5
CVE-2026-23869
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and…
7.5
CVE-2026-23864
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack,…