CVE-2025-55184CWE-502insecure-deserialization

CVE-2025-55184

High Β· published December 12, 2025

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.3th percentile for exploit probability.

CVSS v3.1
7.5
EPSS
67%
Percentile
99.3
In the wild
Unconfirmed
What it is

⚑ A sneaky pre-authentication denial of service vulnerability is lurking in React Server Components! 🚨 Think of this vulnerability like a restaurant that receives a never-ending stream of orders but can't serve any food because the kitchen has run into a cooking disaster. Once the server gets stuck in this infinite loop, it's not just slow serviceβ€”it's a complete shutdown! This bug can cause your server to hang indefinitely, preventing any future HTTP requests from being processed. It's like a restaurant that’s so overwhelmed by one chaotic order that they stop serving customers altogether, leading to potential downtime and frustrated users.

Put simply

Think of this vulnerability like a restaurant that receives a never-ending stream of orders but can't serve any food because the kitchen has run into a cooking disaster. Once the server gets stuck in this infinite loop, it's not just slow serviceβ€”it's a complete shutdown! In React Server Components versions 19.0.0 to 19.2.1, the vulnerability arises from unsafe deserialization of payloads sent to Server Function endpoints. This flaw allows attackers to trigger an infinite loop that freezes the server process.

What to do

This bug can cause your server to hang indefinitely, preventing any future HTTP requests from being processed. It's like a restaurant that’s so overwhelmed by one chaotic order that they stop serving customers altogether, leading to potential downtime and frustrated users. To safeguard your application, update React Server Components to version 19.2.2 or higher immediately. Review your server configurations to ensure proper payload validation and implement rate limiting to mitigate excessive requests. You've got this! With these steps, you can keep your server running smoothly and securely. πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
7.5 Β· HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.66882 Β· 99.3th percentile
Weakness
CWE-502 Β· Deserialization of Untrusted Data
Published
2025-12-12T01:16Z
Affected products (92)
ProductVersionsFixed in
facebook/reactβ‰₯ 19.0.0, < 19.0.219.0.2
facebook/reactβ‰₯ 19.1.0, < 19.1.319.1.3
facebook/reactβ‰₯ 19.2.0, < 19.2.219.2.2
vercel/next.jsβ‰₯ 13.3.0, < 14.2.3514.2.35
vercel/next.jsβ‰₯ 15.0.0, < 15.0.715.0.7
vercel/next.jsβ‰₯ 15.1.0, < 15.1.1115.1.11
vercel/next.jsβ‰₯ 15.2.0, < 15.2.815.2.8
vercel/next.jsβ‰₯ 15.3.0, < 15.3.815.3.8
vercel/next.jsβ‰₯ 15.4.0, < 15.4.1015.4.10
vercel/next.jsβ‰₯ 15.5.0, < 15.5.915.5.9
vercel/next.jsβ‰₯ 16.0.0, < 16.0.1016.0.10
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
vercel/next.jsall versionsβ€”
References (3)
EPSS history
Timeline
  • 11 DEC 20:05Z
    A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1…
    cvelistv5