CVE-2025-55184 Denial of Service Vulnerability in React Server Components
Attackers can cause a denial of service by sending malicious payloads to React Server Function endpoints, hanging the server process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55184?
CVE-2025-55184 is a high-severity denial of service vulnerability in Vercel Next.js, published on 11 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Weakness: CWE-502
Which versions are affected by CVE-2025-55184?
18 open source packages ship an affected version, including react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
react-server-dom-parcel npm | From 19.0.0 | 19.0.2 |
react-server-dom-parcel npm | From 19.0.0 | 19.0.2 |
react-server-dom-parcel npm | From 19.1.0 | 19.1.3 |
react-server-dom-parcel npm | From 19.1.0 | 19.1.3 |
react-server-dom-parcel npm | From 19.2.0 | 19.2.2 |
react-server-dom-parcel npm | From 19.2.0 | 19.2.2 |
12 more packages
react-server-dom-turbopack npm | From 19.0.0 | 19.0.2 |
react-server-dom-turbopack npm | From 19.0.0 | 19.0.2 |
react-server-dom-turbopack npm | From 19.1.0 | 19.1.3 |
react-server-dom-turbopack npm | From 19.1.0 | 19.1.3 |
react-server-dom-turbopack npm | From 19.2.0 | 19.2.2 |
react-server-dom-turbopack npm | From 19.2.0 | 19.2.2 |
react-server-dom-webpack npm | From 19.0.0 | 19.0.2 |
react-server-dom-webpack npm | From 19.0.0 | 19.0.2 |
react-server-dom-webpack npm | From 19.1.0 | 19.1.3 |
react-server-dom-webpack npm | From 19.1.0 | 19.1.3 |
react-server-dom-webpack npm | From 19.2.0 | 19.2.2 |
react-server-dom-webpack npm | From 19.2.0 | 19.2.2 |
Products include Facebook React, Vercel Next.js.
How do I fix CVE-2025-55184?
Upgrade react-server-dom-parcel to a fixed version for your release line: 19.0.2, 19.1.3 or 19.2.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-55184 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-55184 exists.
Public exploit code: 1 Nuclei template and 9 proofs of concept on GitHub.
Other vulnerabilities in Vercel Next.js
- CVE-2025-55182 Meta React Server Components Remote Code Execution
- CVE-2026-23864 React Server Components have multiple Denial of Service Vulnerabilities
- CVE-2025-67779 Denial of Service Vulnerability in React Server Components
- CVE-2018-6341 Cross-Site Scripting in react-dom
- CVE-2025-55183 Source Code Exposure Vulnerability in React Server Components
Sources
Also known as GHSA-2m3v-v2m8-q956.