What is the CVSS score of CVE-2025-67779?

CVE-2025-67779 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 20.0%.

How to fix or mitigate CVE-2025-67779?

Within 24 hours, inventory every application running React 19.0.2, 19.1.3, or 19.2.2 and every Next.js application on Node.js that exposes Server Functions (Server Actions), flagging which are internet-facing; confirm with the vendor advisories that no vendor-released patch is yet available for CVE-2025-67779, and apply interim edge controls on those endpoints (rate limiting, request-size and complexity limits, reverse-proxy and connection timeouts) plus process supervision with automatic restart and alerting on hung or unresponsive Node.js workers. Within 7 days, re-apply or extend the mitigations documented for the earlier CVE-2025-55184 advisory since this is an incomplete fix of that issue - including any documented Server Actions configuration hardening - and, where business tolerance allows, temporarily disable or gate unauthenticated Server Function endpoints behind authentication and network allow-lists; validate the controls under load to confirm a single request can no longer exhaust a worker pool, and confirm horizontal capacity and failover so that one hung instance does not take down the service. Within 30 days, upgrade all affected React 19 deployments to the first vendor-released fixed version as soon as it is published (tracking React 19.x and corresponding Next.js release notes, since no fixed version is identified at time of analysis), re-test the reproduction case after upgrade to verify the loop is closed, and fold the finding into dependency-governance and availability-resilience reviews covering monitoring, autoscaling, and DoS testing for framework-level Server Function endpoints.

React Server Components CVE-2025-67779

Q: Which versions of React Server Components are affected by CVE-2025-67779?

Internet-facing web applications built on React 19.0.2, 19.1.3, and 19.2.2 - including Next.js applications on Node.js that expose Server Functions (Server Actions) - can be driven into an infinite…. A patch is available.

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-12-12 cve-assign@fb.com

Denial Of Service Deserialization React Node Js Next Js

7.5

CVSS 3.1 · Vendor: fb

Severity by source

Vendor (fb) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP request to a Server Function endpoint triggers an infinite loop (AV:N/AC:L/PR:N/UI:N); impact is availability-only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (fb).

CVSS VectorVendor: fb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Metadata Corrected

Oct 07, 2026 - 21:40 vuln.today

tag: Node Js added

Analysis Generated

Oct 07, 2026 - 20:48 vuln.today

CVE Published

Dec 12, 2025 - 00:15 cve.org

HIGH 7.5

DescriptionCVE.org

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

AnalysisAI

Unsafe deserialization in React Server Components Server Function endpoints allows remote unauthenticated attackers to trigger an infinite loop that hangs the server process and can prevent subsequent HTTP requests from being served. The flaw affects React 19.0.2, 19.1.3, and 19.2.2 - including Next.js applications on Node.js that expose Server Functions (Server Actions) - and it represents an incomplete fix for CVE-2025-55184. EPSS is 19.99% (97th percentile), and no public exploit identified at time of analysis; CISA KEV does not list it as confirmed actively exploited.

Technical ContextAI

The root cause is CWE-502 unsafe deserialization. React Server Components expose Server Functions (Server Actions) over HTTP, and the vulnerable parser deserializes incoming request payloads along a specific edge case that the CVE-2025-55184 fix missed, creating an infinite loop in the deserialization logic. Because the handler never completes, the Node.js process hangs and may stop serving further HTTP requests. The assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms remote, unauthenticated, low-complexity exploitation with no user interaction and availability-only impact; CPEs list facebook:react 19.0.2, 19.1.3, and 19.2.2 plus vercel:next.js on node.js. Only deployments that expose Server Function endpoints reach this vulnerable path, so applications without Server Functions are not affected by this vector.

RemediationAI

Apply the fixed React Server Components release identified in the vendor advisories at https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components and https://www.facebook.com/security/advisories/cve-2025-67779; the provided data does not enumerate an exact patched version number, so verify the fixed version for CVE-2025-67779 and update React 19.0.2, 19.1.3, or 19.2.2, along with any affected Next.js on Node.js deployment accordingly. Patch status is best described as patch available per vendor advisory, not with a version in this input. If immediate upgrade is not possible, reduce exposure by disabling or blocking Server Function (Server Action) endpoints so untrusted external HTTP requests cannot reach the vulnerable deserialization path; this breaks functionality that relies on Server Actions, so it should be temporary. Additional compensating controls include front-end or WAF rate limiting and request size limits on those endpoints to make the infinite-loop payload harder to deliver, though these are not complete fixes. Because exploitation requires the application to expose Server Functions, internal-only deployments may have a smaller attack surface, but any publicly reachable Server Function endpoint remains at risk.