CVE-2025-55184
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
Pre-authentication denial of service vulnerability in React Server Components versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack, allows unsafe deserialization of payloads from HTTP requests to Server Function endpoints, causing an infinite loop that hangs the server process.
Risk Assessment
An attacker can cause denial of service by hanging the server, preventing future HTTP requests from being served, potentially disrupting application availability.
Recommendation
Upgrade React Server Components to a patched version (e.g., 19.0.2, 19.1.3, 19.2.2 or later if available). Restrict access to Server Function endpoints.
Other vulnerabilities in React Server Components
See all- CVE-2025-67779High
Vulnerability in React Server Components versions 19.0.2, 19.1.3 and 19.2.2 is an incomplete fix for CVE-2025-55184 and still allows unsafe deserialization of payloads from HTTP requests to Server Function endpoints, causing an infinite loop that hangs the server process.
- CVE-2025-55182CriticalActively exploited
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
- CVE-2026-23869High
A denial of service vulnerability in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) versions 19.0.0-19.0.4, 19.1.0-19.1.5, and 19.2.0-19.2.4. Specially crafted HTTP requests to Server Function endpoints cause excessive CPU usage for about a minute, ending in a catchable error.
- CVE-2026-23864High
Multiple denial of service vulnerabilities have been found in React Server Components packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack). Specially crafted HTTP requests to Server Function endpoints can cause server crashes, out-of-memory exceptions, or excessive CPU usage.
Original NVD description (English source)
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS