Pre-authentication Denial of Service Vulnerability in React Server Components
CVE-2025-55184

7.5HIGH

Key Information:

Vendor

Meta

Status
React-server-dom-webpack
React-server-dom-turbopack
React-server-dom-parcel
Vendor
CVE Published:
11 December 2025

What is CVE-2025-55184?

This vulnerability affects multiple versions of React Server Components by allowing malicious payloads sent through HTTP requests to Server Function endpoints to be unsafely deserialized. This can result in an infinite loop that hangs the server process, effectively blocking future HTTP requests and disrupting service continuity. It highlights the need for stringent data handling practices within web applications to mitigate potential service outages.

Affected Version(s)

react-server-dom-parcel 19.0.0 <= 19.0.1

react-server-dom-parcel 19.1.0 <= 19.1.2

react-server-dom-parcel 19.2.0 <= 19.2.1

References

https://www.facebook.com/security/advisories/cve-2025-55184
x_refsource_CONFIRM
https://react.dev/blog/2025/12/11/denial-of-service-and-s...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-55184 : Pre-authentication Denial of Service Vulnerability in React Server Components