CVE-2025-67779
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
Vulnerability in React Server Components versions 19.0.2, 19.1.3 and 19.2.2 is an incomplete fix for CVE-2025-55184 and still allows unsafe deserialization of payloads from HTTP requests to Server Function endpoints, causing an infinite loop that hangs the server process.
Risk Assessment
An attacker can still perform DoS attacks by hanging the server, preventing future HTTP requests from being served, potentially disrupting application availability.
Recommendation
Upgrade React Server Components to a fully patched version if available. Restrict access to Server Function endpoints and monitor for anomalies.
Other vulnerabilities in React Server Components
See all- CVE-2025-55184High
Pre-authentication denial of service vulnerability in React Server Components versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack, allows unsafe deserialization of payloads from HTTP requests to Server Function endpoints, causing an infinite loop that hangs the server process.
- CVE-2025-55182CriticalActively exploited
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
- CVE-2026-23869High
A denial of service vulnerability in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) versions 19.0.0-19.0.4, 19.1.0-19.1.5, and 19.2.0-19.2.4. Specially crafted HTTP requests to Server Function endpoints cause excessive CPU usage for about a minute, ending in a catchable error.
- CVE-2026-23864High
Multiple denial of service vulnerabilities have been found in React Server Components packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack). Specially crafted HTTP requests to Server Function endpoints can cause server crashes, out-of-memory exceptions, or excessive CPU usage.
Original NVD description (English source)
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS