Vulnerability record · CVE-2025-55184 · published 11 December 2025
CVE-2025-55184: React Server Components pre-auth deserialization denial of service
Facebook · React
React Server Components versions 19.0.0 through 19.2.1 (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) unsafely deserialize payloads from HTTP requests to Server Function endpoints. A crafted payload triggers an infinite loop that hangs the server process and can block subsequent HTTP requests, making this a remotely reachable availability issue in affected React and Next.js deployments.
Description
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityUnauthenticated network-reachable denial of service with a CVSS of 7.5 and very high EPSS, though no confirmed in-the-wild exploitation or KEV listing.
What it is
React Server Components versions 19.0.0 through 19.2.1 (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) unsafely deserialize payloads from HTTP requests to Server Function endpoints. A crafted payload triggers an infinite loop that hangs the server process and can block subsequent HTTP requests, making this a remotely reachable availability issue in affected React and Next.js deployments.
Impact
An unauthenticated attacker can hang the server process and deny service to legitimate users, potentially requiring a restart to recover. There is no confidentiality or integrity impact per the CVSS vector; only availability is affected.
Attack surface
Reached over the network by sending crafted HTTP requests to Server Function endpoints that deserialize untrusted payloads. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N).
Exploitation
Not listed in CISA KEV and no ransomware association is documented. EPSS is high (0.66882, 99.259th percentile), and a public GitHub repository referencing the CVE exists, indicating active interest, but the record does not confirm in-the-wild exploitation.
What to do
- Upgrade React Server Components packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) and React/Next.js to a version that fixes the unsafe deserialization; consult the React and Facebook advisories for the fixed release.
- If immediate patching is not possible, restrict or rate-limit access to Server Function endpoints at the edge or reverse proxy.
- Deploy process supervision or automatic restart for Node.js server processes so a hung worker recovers without prolonged downtime.
- Monitor for and block malformed or oversized payloads to Server Function endpoints as a temporary compensating control.
Detection
- Monitor server processes for CPU saturation or event-loop stalls correlated with requests to Server Function endpoints.
- Alert on request timeouts, 5xx spikes, or health-check failures on React/Next.js hosts that require manual restarts.
- Log and review payloads sent to Server Function endpoints for anomalies suggesting deserialization abuse.
- Track Node.js process restarts and correlate them with inbound request patterns to identify repeat abuse.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2025-55184 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-55184), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
