What is the CVSS score of CVE-2025-55184?

CVE-2025-55184 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 66.9%.

Which versions of React Server Components are affected by CVE-2025-55184?

Organizations using React Server Components versions 19.0.0 through 19.2.1, commonly deployed via Next.js App Router with packages such as react-server-dom-parcel, react-server-dom-turbopack, or…. A patch is available.

Is there a public PoC exploit available for CVE-2025-55184?

Yes, a public proof-of-concept exploit is available for CVE-2025-55184. Prioritise patching immediately. EPSS: 66.9%.

How to fix or mitigate CVE-2025-55184?

Within 24 hours, inventory all applications using React Server Components versions 19.0.0 through 19.2.1, particularly those leveraging the react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack packages, and apply emergency rate limiting and WAF rules to block exploit attempts on Server Function endpoints. Within 7 days, evaluate whether downgrading to a version prior to 19.0.0 is feasible or if Server Function endpoints can be temporarily disabled without breaking business-critical functionality; implement enhanced monitoring and logging for denial-of-service indicators. Within 30 days, apply the vendor patch as soon as it is released and conduct a post-mitigation review to ensure no residual exposure.

React Server Components CVE-2025-55184

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-12-11 cve-assign@fb.com

Denial Of Service Deserialization React Next Js

7.5

CVSS 3.1 · Vendor: fb

Severity by source

Vendor (fb) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated request to a Server Function endpoint (AV:N/PR:N/UI:N) with low complexity triggers an infinite loop causing availability loss only (A:H, C/I:N), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (fb).

CVSS VectorVendor: fb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 20:51 vuln.today

CVE Published

Dec 11, 2025 - 20:16 cve.org

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

10 npm packages depend on react-server-dom-webpack (6 direct, 4 indirect)

Ecosystem-wide dependent count for version 19.0.0.

DescriptionCVE.org

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

AnalysisAI

Pre-authentication denial of service in React Server Components (versions 19.0.0 through 19.2.1) allows unauthenticated remote attackers to hang the server process by sending specially crafted payloads to Server Function endpoints, causing an infinite loop that prevents further HTTP requests from being served. This affects applications using the react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack packages, commonly seen in Next.js App Router deployments. Publicly available exploit code exists (e.g., GitHub repository referenced), and the EPSS score is 66.88% (99th percentile), indicating a high likelihood of exploitation; however, there is no confirmation of active exploitation in CISA KEV.

Technical ContextAI

The vulnerability is a CWE-502 (Deserialization of Untrusted Data) issue in React Server Components' handling of HTTP requests to Server Function endpoints. Specifically, the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages unsafely deserialize payloads, which can be manipulated to trigger an infinite loop, consuming server resources and causing a denial of service. The affected components are part of the React 19.x line, and are used by frameworks like Next.js (CPE: vercel:next.js) to implement server-side rendering and Server Actions. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms that exploitation is network-based, requires no authentication or user interaction, and results in a high availability impact only.

RemediationAI

Consult the vendor advisory at https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components for the latest patched version and upgrade instructions; no exact fix version is specified in the available intelligence. As a compensating control, restrict network access to Server Function endpoints (e.g., via firewall rules or authentication proxies) to reduce exposure, though this may impact legitimate application functionality. Additionally, implement rate limiting and input validation on Server Function endpoints to mitigate the infinite loop condition. If Server Actions are not required, consider disabling them, but note that this will break related features. Monitor for unusual CPU or memory usage that could indicate exploitation attempts.