Riskcovery

CVE-2025-67779

State
Published
Severity
7.5 High
Published
Dec 11, 2025
Updated
Dec 12, 2025
Reserved
Dec 11, 2025

Read the record on cve.org

Description

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HMeta

Weaknesses

  • CWE-502 Deserialization of Untrusted Data
  • CWE-400 Uncontrolled Resource Consumption

Affected Products

ProductVersions
react-server-dom-parcelMeta
  • 19.0.2 through 19.0.2Affected
  • 19.1.3 through 19.1.3Affected
  • 19.2.2 through 19.2.2Affected
react-server-dom-turbopackMeta
  • 19.0.2 through 19.0.2Affected
  • 19.1.3 through 19.1.3Affected
  • 19.2.2 through 19.2.2Affected
react-server-dom-webpackMeta
  • 19.0.2 through 19.0.2Affected
  • 19.1.3 through 19.1.3Affected
  • 19.2.2 through 19.2.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.