CVE-2025-67779 Denial of Service Vulnerability in React Server Components
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2025-67779?
CVE-2025-67779 is a high-severity vulnerability in Vercel Next.js, published on 11 Dec 2025.
Official description
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Which versions are affected by CVE-2025-67779?
18 open source packages ship an affected version, including react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
react-server-dom-parcel npm | From 19.0.2 | 19.0.3 |
react-server-dom-parcel npm | From 19.0.2 | 19.0.3 |
react-server-dom-parcel npm | From 19.1.3 | 19.1.4 |
react-server-dom-parcel npm | From 19.1.3 | 19.1.4 |
react-server-dom-parcel npm | From 19.2.2 | 19.2.3 |
react-server-dom-parcel npm | From 19.2.2 | 19.2.3 |
12 more packages
react-server-dom-turbopack npm | From 19.0.2 | 19.0.3 |
react-server-dom-turbopack npm | From 19.0.2 | 19.0.3 |
react-server-dom-turbopack npm | From 19.1.3 | 19.1.4 |
react-server-dom-turbopack npm | From 19.1.3 | 19.1.4 |
react-server-dom-turbopack npm | From 19.2.2 | 19.2.3 |
react-server-dom-turbopack npm | From 19.2.2 | 19.2.3 |
react-server-dom-webpack npm | From 19.0.2 | 19.0.3 |
react-server-dom-webpack npm | From 19.0.2 | 19.0.3 |
react-server-dom-webpack npm | From 19.1.3 | 19.1.4 |
react-server-dom-webpack npm | From 19.1.3 | 19.1.4 |
react-server-dom-webpack npm | From 19.2.2 | 19.2.3 |
react-server-dom-webpack npm | From 19.2.2 | 19.2.3 |
Products include Facebook React, Vercel Next.js.
How do I fix CVE-2025-67779?
Upgrade react-server-dom-parcel to a fixed version for your release line: 19.0.3, 19.1.4 or 19.2.3.
Is CVE-2025-67779 being exploited?
There is no known exploitation of CVE-2025-67779 in the wild and no public exploit code.
Other vulnerabilities in Vercel Next.js
- CVE-2025-55182 Meta React Server Components Remote Code Execution
- CVE-2026-23864 React Server Components have multiple Denial of Service Vulnerabilities
- CVE-2025-55184 Denial of Service Vulnerability in React Server Components
- CVE-2018-6341 Cross-Site Scripting in react-dom
- CVE-2025-55183 Source Code Exposure Vulnerability in React Server Components
Sources
Also known as GHSA-7gmr-mq3h-m5h9.