High Β· published December 12, 2025
CVSS calls it high at 7.5. It sits in the 99.3th percentile for exploit probability.
β‘ A sneaky pre-authentication denial of service vulnerability is lurking in React Server Components! π¨ Think of this vulnerability like a restaurant that receives a never-ending stream of orders but can't serve any food because the kitchen has run into a cooking disaster. Once the server gets stuck in this infinite loop, it's not just slow serviceβit's a complete shutdown! This bug can cause your server to hang indefinitely, preventing any future HTTP requests from being processed. It's like a restaurant thatβs so overwhelmed by one chaotic order that they stop serving customers altogether, leading to potential downtime and frustrated users.
Think of this vulnerability like a restaurant that receives a never-ending stream of orders but can't serve any food because the kitchen has run into a cooking disaster. Once the server gets stuck in this infinite loop, it's not just slow serviceβit's a complete shutdown! In React Server Components versions 19.0.0 to 19.2.1, the vulnerability arises from unsafe deserialization of payloads sent to Server Function endpoints. This flaw allows attackers to trigger an infinite loop that freezes the server process.
This bug can cause your server to hang indefinitely, preventing any future HTTP requests from being processed. It's like a restaurant thatβs so overwhelmed by one chaotic order that they stop serving customers altogether, leading to potential downtime and frustrated users. To safeguard your application, update React Server Components to version 19.2.2 or higher immediately. Review your server configurations to ensure proper payload validation and implement rate limiting to mitigate excessive requests. You've got this! With these steps, you can keep your server running smoothly and securely. π‘οΈ
| Product | Versions | Fixed in |
|---|---|---|
| facebook/react | β₯ 19.0.0, < 19.0.2 | 19.0.2 |
| facebook/react | β₯ 19.1.0, < 19.1.3 | 19.1.3 |
| facebook/react | β₯ 19.2.0, < 19.2.2 | 19.2.2 |
| vercel/next.js | β₯ 13.3.0, < 14.2.35 | 14.2.35 |
| vercel/next.js | β₯ 15.0.0, < 15.0.7 | 15.0.7 |
| vercel/next.js | β₯ 15.1.0, < 15.1.11 | 15.1.11 |
| vercel/next.js | β₯ 15.2.0, < 15.2.8 | 15.2.8 |
| vercel/next.js | β₯ 15.3.0, < 15.3.8 | 15.3.8 |
| vercel/next.js | β₯ 15.4.0, < 15.4.10 | 15.4.10 |
| vercel/next.js | β₯ 15.5.0, < 15.5.9 | 15.5.9 |
| vercel/next.js | β₯ 16.0.0, < 16.0.10 | 16.0.10 |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |
| vercel/next.js | all versions | β |