Next.js
Description
The React Framework for the Web
Website
Product name
next.js
Related organization
CVE-2025-55182 (GCVE-0-2025-55182)
Vulnerability from – Published: 2025-12-03 15:40 – Updated: 2026-02-26 16:57
VLAI?
Summary
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Severity ?
10 (Critical)
CWE
- Deserialization of Untrusted Data (CWE-502)
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Meta | react-server-dom-webpack |
Affected:
19.0.0 , ≤ 19.0.0
(semver)
Affected: 19.1.0 , ≤ 19.1.1 (semver) Affected: 19.2.0 , ≤ 19.2.0 (semver) |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55182",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-06T04:55:43.783137Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-12-05",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T16:57:36.794Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"media-coverage"
],
"url": "https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-05T00:00:00.000Z",
"value": "CVE-2025-55182 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-12-04T17:32:12.884Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/12/03/4"
},
{
"url": "https://news.ycombinator.com/item?id=46136026"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "react-server-dom-webpack",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.0",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.1",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.0",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "react-server-dom-turbopack",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.0",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.1",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.0",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "react-server-dom-parcel",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.0",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.1",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.0",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2025-12-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Deserialization of Untrusted Data (CWE-502)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-11T20:15:37.699Z",
"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"shortName": "Meta"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.facebook.com/security/advisories/cve-2025-55182"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"assignerShortName": "Meta",
"cveId": "CVE-2025-55182",
"datePublished": "2025-12-03T15:40:56.894Z",
"dateReserved": "2025-08-08T18:21:47.119Z",
"dateUpdated": "2026-02-26T16:57:36.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-55182 (GCVE-0-2025-55182)
Vulnerability from – Published: 2025-12-03 15:40 – Updated: 2026-02-26 16:57
VLAI?
Summary
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Severity ?
10 (Critical)
CWE
- Deserialization of Untrusted Data (CWE-502)
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Meta | react-server-dom-webpack |
Affected:
19.0.0 , ≤ 19.0.0
(semver)
Affected: 19.1.0 , ≤ 19.1.1 (semver) Affected: 19.2.0 , ≤ 19.2.0 (semver) |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55182",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-06T04:55:43.783137Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-12-05",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T16:57:36.794Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"media-coverage"
],
"url": "https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-05T00:00:00.000Z",
"value": "CVE-2025-55182 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-12-04T17:32:12.884Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/12/03/4"
},
{
"url": "https://news.ycombinator.com/item?id=46136026"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "react-server-dom-webpack",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.0",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.1",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.0",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "react-server-dom-turbopack",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.0",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.1",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.0",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "react-server-dom-parcel",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.0",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.1",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.0",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2025-12-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Deserialization of Untrusted Data (CWE-502)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-11T20:15:37.699Z",
"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"shortName": "Meta"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.facebook.com/security/advisories/cve-2025-55182"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"assignerShortName": "Meta",
"cveId": "CVE-2025-55182",
"datePublished": "2025-12-03T15:40:56.894Z",
"dateReserved": "2025-08-08T18:21:47.119Z",
"dateUpdated": "2026-02-26T16:57:36.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-59471 (GCVE-0-2025-59471)
Vulnerability from – Published: 2026-01-26 21:43 – Updated: 2026-01-27 14:55
VLAI?
Summary
A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.
Strongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
Severity ?
5.9 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59471",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-27T14:54:47.995347Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-27T14:55:15.271Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "next",
"vendor": "vercel",
"versions": [
{
"lessThan": "10.0",
"status": "affected",
"version": "10.0",
"versionType": "semver"
},
{
"lessThan": "11.0",
"status": "affected",
"version": "11.0",
"versionType": "semver"
},
{
"lessThan": "12.0",
"status": "affected",
"version": "12.0",
"versionType": "semver"
},
{
"lessThan": "13.0",
"status": "affected",
"version": "13.0",
"versionType": "semver"
},
{
"lessThan": "14.0",
"status": "affected",
"version": "14.0",
"versionType": "semver"
},
{
"lessThan": "15.5.10",
"status": "affected",
"version": "15.0",
"versionType": "semver"
},
{
"lessThan": "16.1.5",
"status": "affected",
"version": "16.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.\r\n\r\nStrongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-26T21:43:05.094Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-59471",
"datePublished": "2026-01-26T21:43:05.094Z",
"dateReserved": "2025-09-16T15:00:07.876Z",
"dateUpdated": "2026-01-27T14:55:15.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-59471 (GCVE-0-2025-59471)
Vulnerability from – Published: 2026-01-26 21:43 – Updated: 2026-01-27 14:55
VLAI?
Summary
A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.
Strongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
Severity ?
5.9 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59471",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-27T14:54:47.995347Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-27T14:55:15.271Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "next",
"vendor": "vercel",
"versions": [
{
"lessThan": "10.0",
"status": "affected",
"version": "10.0",
"versionType": "semver"
},
{
"lessThan": "11.0",
"status": "affected",
"version": "11.0",
"versionType": "semver"
},
{
"lessThan": "12.0",
"status": "affected",
"version": "12.0",
"versionType": "semver"
},
{
"lessThan": "13.0",
"status": "affected",
"version": "13.0",
"versionType": "semver"
},
{
"lessThan": "14.0",
"status": "affected",
"version": "14.0",
"versionType": "semver"
},
{
"lessThan": "15.5.10",
"status": "affected",
"version": "15.0",
"versionType": "semver"
},
{
"lessThan": "16.1.5",
"status": "affected",
"version": "16.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.\r\n\r\nStrongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-26T21:43:05.094Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-59471",
"datePublished": "2026-01-26T21:43:05.094Z",
"dateReserved": "2025-09-16T15:00:07.876Z",
"dateUpdated": "2026-01-27T14:55:15.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-59472 (GCVE-0-2025-59472)
Vulnerability from – Published: 2026-01-26 21:43 – Updated: 2026-01-27 14:54
VLAI?
Summary
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:
1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.
2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.
Both attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.
To be affected you must have an application running with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.
Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
Severity ?
5.9 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| vercel | next |
Affected:
15.0.0-canary.0 , < 15.0.0
(semver)
Affected: 15.0.1-canary.0 , < 15.0.1 (semver) Affected: 15.0.2-canary.0 , < 15.0.2 (semver) Affected: 15.0.3-canary.0 , < 15.0.3 (semver) Affected: 15.0.4-canary.0 , < 15.0.4 (semver) Affected: 15.1.0-canary.0 , < 15.1.0 (semver) Affected: 15.1.1-canary.0 , < 15.1.1 (semver) Affected: 15.1.2-canary.0 , < 15.1.2 (semver) Affected: 15.1.3-canary.0 , < 15.1.3 (semver) Affected: 15.1.4-canary.0 , < 15.1.4 (semver) Affected: 15.1.5-canary.0 , < 15.1.5 (semver) Affected: 15.1.6-canary.0 , < 15.1.6 (semver) Affected: 15.1.7-canary.0 , < 15.1.7 (semver) Affected: 15.2.0-canary.0 , < 15.2.0 (semver) Affected: 15.2.1-canary.0 , < 15.2.1 (semver) Affected: 15.2.2-canary.0 , < 15.2.2 (semver) Affected: 15.2.3-canary.0 , < 15.2.3 (semver) Affected: 15.2.4-canary.0 , < 15.2.4 (semver) Affected: 15.2.5-canary.0 , < 15.2.5 (semver) Affected: 15.3.0-canary.0 , < 15.3.0 (semver) Affected: 15.3.1-canary.0 , < 15.3.1 (semver) Affected: 15.3.2-canary.0 , < 15.3.2 (semver) Affected: 15.1.8-canary.0 , < 15.1.8 (semver) Affected: 15.3.3-canary.0 , < 15.3.3 (semver) Affected: 15.4.0-canary.0 , < 15.4.0 (semver) Affected: 15.3.4-canary.0 , < 15.3.4 (semver) Affected: 15.3.5-canary.0 , < 15.3.5 (semver) Affected: 15.4.1-canary.0 , < 15.4.1 (semver) Affected: 15.4.2-canary.0 , < 15.4.2 (semver) Affected: 15.4.3-canary.0 , < 15.4.3 (semver) Affected: 15.4.4-canary.0 , < 15.4.4 (semver) Affected: 15.4.5-canary.0 , < 15.4.5 (semver) Affected: 15.4.6-canary.0 , < 15.4.6 (semver) Affected: 15.4.7-canary.0 , < 15.4.7 (semver) Affected: 15.5.0-canary.0 , < 15.5.0 (semver) Affected: 15.5.1-canary.0 , < 15.5.1 (semver) Affected: 15.5.2-canary.0 , < 15.5.2 (semver) Affected: 15.5.3-canary.0 , < 15.5.3 (semver) Affected: 15.5.4-canary.0 , < 15.5.4 (semver) Affected: 15.5.5-canary.0 , < 15.5.5 (semver) Affected: 15.5.6-canary.0 , < 15.5.6 (semver) Affected: 15.5.7-canary.0 , < 15.5.7 (semver) Affected: 15.4.8-canary.0 , < 15.4.8 (semver) Affected: 15.1.9-canary.0 , < 15.1.9 (semver) Affected: 15.0.5-canary.0 , < 15.0.5 (semver) Affected: 15.3.6-canary.0 , < 15.3.6 (semver) Affected: 15.2.6-canary.0 , < 15.2.6 (semver) Affected: 15.5.8-canary.0 , < 15.5.8 (semver) Affected: 15.4.9-canary.0 , < 15.4.9 (semver) Affected: 15.3.7-canary.0 , < 15.3.7 (semver) Affected: 15.2.7-canary.0 , < 15.2.7 (semver) Affected: 15.1.10-canary.0 , < 15.1.10 (semver) Affected: 15.0.6-canary.0 , < 15.0.6 (semver) Affected: 15.5.9-canary.0 , < 15.5.9 (semver) Affected: 15.4.10-canary.0 , < 15.4.10 (semver) Affected: 15.3.8-canary.0 , < 15.3.8 (semver) Affected: 15.2.8-canary.0 , < 15.2.8 (semver) Affected: 15.1.11-canary.0 , < 15.1.11 (semver) Affected: 15.0.7-canary.0 , < 15.0.7 (semver) Affected: 16.1.0 , < 16.1.5 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59472",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-27T14:52:42.677682Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-27T14:54:04.986Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "next",
"vendor": "vercel",
"versions": [
{
"lessThan": "15.0.0",
"status": "affected",
"version": "15.0.0-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.1",
"status": "affected",
"version": "15.0.1-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.2",
"status": "affected",
"version": "15.0.2-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.3",
"status": "affected",
"version": "15.0.3-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.4",
"status": "affected",
"version": "15.0.4-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.0",
"status": "affected",
"version": "15.1.0-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.1",
"status": "affected",
"version": "15.1.1-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.2",
"status": "affected",
"version": "15.1.2-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.3",
"status": "affected",
"version": "15.1.3-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.4",
"status": "affected",
"version": "15.1.4-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.5",
"status": "affected",
"version": "15.1.5-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.6",
"status": "affected",
"version": "15.1.6-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.7",
"status": "affected",
"version": "15.1.7-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.0",
"status": "affected",
"version": "15.2.0-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.1",
"status": "affected",
"version": "15.2.1-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.2",
"status": "affected",
"version": "15.2.2-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.3",
"status": "affected",
"version": "15.2.3-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.4",
"status": "affected",
"version": "15.2.4-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.5",
"status": "affected",
"version": "15.2.5-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.0",
"status": "affected",
"version": "15.3.0-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.1",
"status": "affected",
"version": "15.3.1-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.2",
"status": "affected",
"version": "15.3.2-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.8",
"status": "affected",
"version": "15.1.8-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.3",
"status": "affected",
"version": "15.3.3-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.0",
"status": "affected",
"version": "15.4.0-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.4",
"status": "affected",
"version": "15.3.4-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.5",
"status": "affected",
"version": "15.3.5-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.1",
"status": "affected",
"version": "15.4.1-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.2",
"status": "affected",
"version": "15.4.2-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.3",
"status": "affected",
"version": "15.4.3-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.4",
"status": "affected",
"version": "15.4.4-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.5",
"status": "affected",
"version": "15.4.5-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.6",
"status": "affected",
"version": "15.4.6-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.7",
"status": "affected",
"version": "15.4.7-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.0",
"status": "affected",
"version": "15.5.0-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.1",
"status": "affected",
"version": "15.5.1-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.2",
"status": "affected",
"version": "15.5.2-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.3",
"status": "affected",
"version": "15.5.3-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.4",
"status": "affected",
"version": "15.5.4-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.5",
"status": "affected",
"version": "15.5.5-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.6",
"status": "affected",
"version": "15.5.6-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.7",
"status": "affected",
"version": "15.5.7-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.8",
"status": "affected",
"version": "15.4.8-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.9",
"status": "affected",
"version": "15.1.9-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.5",
"status": "affected",
"version": "15.0.5-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.6",
"status": "affected",
"version": "15.3.6-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.6",
"status": "affected",
"version": "15.2.6-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.8",
"status": "affected",
"version": "15.5.8-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.9",
"status": "affected",
"version": "15.4.9-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.7",
"status": "affected",
"version": "15.3.7-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.7",
"status": "affected",
"version": "15.2.7-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.10",
"status": "affected",
"version": "15.1.10-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.6",
"status": "affected",
"version": "15.0.6-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.9",
"status": "affected",
"version": "15.5.9-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.10",
"status": "affected",
"version": "15.4.10-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.8",
"status": "affected",
"version": "15.3.8-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.8",
"status": "affected",
"version": "15.2.8-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.11",
"status": "affected",
"version": "15.1.11-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.7",
"status": "affected",
"version": "15.0.7-canary.0",
"versionType": "semver"
},
{
"lessThan": "16.1.5",
"status": "affected",
"version": "16.1.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:\n\n1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.\n\n2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.\n\nBoth attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.\n\nTo be affected you must have an application running with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.\n\nStrongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-26T21:43:05.099Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-59472",
"datePublished": "2026-01-26T21:43:05.099Z",
"dateReserved": "2025-09-16T15:00:07.876Z",
"dateUpdated": "2026-01-27T14:54:04.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-59472 (GCVE-0-2025-59472)
Vulnerability from – Published: 2026-01-26 21:43 – Updated: 2026-01-27 14:54
VLAI?
Summary
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:
1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.
2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.
Both attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.
To be affected you must have an application running with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.
Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
Severity ?
5.9 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| vercel | next |
Affected:
15.0.0-canary.0 , < 15.0.0
(semver)
Affected: 15.0.1-canary.0 , < 15.0.1 (semver) Affected: 15.0.2-canary.0 , < 15.0.2 (semver) Affected: 15.0.3-canary.0 , < 15.0.3 (semver) Affected: 15.0.4-canary.0 , < 15.0.4 (semver) Affected: 15.1.0-canary.0 , < 15.1.0 (semver) Affected: 15.1.1-canary.0 , < 15.1.1 (semver) Affected: 15.1.2-canary.0 , < 15.1.2 (semver) Affected: 15.1.3-canary.0 , < 15.1.3 (semver) Affected: 15.1.4-canary.0 , < 15.1.4 (semver) Affected: 15.1.5-canary.0 , < 15.1.5 (semver) Affected: 15.1.6-canary.0 , < 15.1.6 (semver) Affected: 15.1.7-canary.0 , < 15.1.7 (semver) Affected: 15.2.0-canary.0 , < 15.2.0 (semver) Affected: 15.2.1-canary.0 , < 15.2.1 (semver) Affected: 15.2.2-canary.0 , < 15.2.2 (semver) Affected: 15.2.3-canary.0 , < 15.2.3 (semver) Affected: 15.2.4-canary.0 , < 15.2.4 (semver) Affected: 15.2.5-canary.0 , < 15.2.5 (semver) Affected: 15.3.0-canary.0 , < 15.3.0 (semver) Affected: 15.3.1-canary.0 , < 15.3.1 (semver) Affected: 15.3.2-canary.0 , < 15.3.2 (semver) Affected: 15.1.8-canary.0 , < 15.1.8 (semver) Affected: 15.3.3-canary.0 , < 15.3.3 (semver) Affected: 15.4.0-canary.0 , < 15.4.0 (semver) Affected: 15.3.4-canary.0 , < 15.3.4 (semver) Affected: 15.3.5-canary.0 , < 15.3.5 (semver) Affected: 15.4.1-canary.0 , < 15.4.1 (semver) Affected: 15.4.2-canary.0 , < 15.4.2 (semver) Affected: 15.4.3-canary.0 , < 15.4.3 (semver) Affected: 15.4.4-canary.0 , < 15.4.4 (semver) Affected: 15.4.5-canary.0 , < 15.4.5 (semver) Affected: 15.4.6-canary.0 , < 15.4.6 (semver) Affected: 15.4.7-canary.0 , < 15.4.7 (semver) Affected: 15.5.0-canary.0 , < 15.5.0 (semver) Affected: 15.5.1-canary.0 , < 15.5.1 (semver) Affected: 15.5.2-canary.0 , < 15.5.2 (semver) Affected: 15.5.3-canary.0 , < 15.5.3 (semver) Affected: 15.5.4-canary.0 , < 15.5.4 (semver) Affected: 15.5.5-canary.0 , < 15.5.5 (semver) Affected: 15.5.6-canary.0 , < 15.5.6 (semver) Affected: 15.5.7-canary.0 , < 15.5.7 (semver) Affected: 15.4.8-canary.0 , < 15.4.8 (semver) Affected: 15.1.9-canary.0 , < 15.1.9 (semver) Affected: 15.0.5-canary.0 , < 15.0.5 (semver) Affected: 15.3.6-canary.0 , < 15.3.6 (semver) Affected: 15.2.6-canary.0 , < 15.2.6 (semver) Affected: 15.5.8-canary.0 , < 15.5.8 (semver) Affected: 15.4.9-canary.0 , < 15.4.9 (semver) Affected: 15.3.7-canary.0 , < 15.3.7 (semver) Affected: 15.2.7-canary.0 , < 15.2.7 (semver) Affected: 15.1.10-canary.0 , < 15.1.10 (semver) Affected: 15.0.6-canary.0 , < 15.0.6 (semver) Affected: 15.5.9-canary.0 , < 15.5.9 (semver) Affected: 15.4.10-canary.0 , < 15.4.10 (semver) Affected: 15.3.8-canary.0 , < 15.3.8 (semver) Affected: 15.2.8-canary.0 , < 15.2.8 (semver) Affected: 15.1.11-canary.0 , < 15.1.11 (semver) Affected: 15.0.7-canary.0 , < 15.0.7 (semver) Affected: 16.1.0 , < 16.1.5 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59472",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-27T14:52:42.677682Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-27T14:54:04.986Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "next",
"vendor": "vercel",
"versions": [
{
"lessThan": "15.0.0",
"status": "affected",
"version": "15.0.0-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.1",
"status": "affected",
"version": "15.0.1-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.2",
"status": "affected",
"version": "15.0.2-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.3",
"status": "affected",
"version": "15.0.3-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.4",
"status": "affected",
"version": "15.0.4-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.0",
"status": "affected",
"version": "15.1.0-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.1",
"status": "affected",
"version": "15.1.1-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.2",
"status": "affected",
"version": "15.1.2-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.3",
"status": "affected",
"version": "15.1.3-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.4",
"status": "affected",
"version": "15.1.4-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.5",
"status": "affected",
"version": "15.1.5-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.6",
"status": "affected",
"version": "15.1.6-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.7",
"status": "affected",
"version": "15.1.7-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.0",
"status": "affected",
"version": "15.2.0-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.1",
"status": "affected",
"version": "15.2.1-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.2",
"status": "affected",
"version": "15.2.2-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.3",
"status": "affected",
"version": "15.2.3-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.4",
"status": "affected",
"version": "15.2.4-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.5",
"status": "affected",
"version": "15.2.5-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.0",
"status": "affected",
"version": "15.3.0-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.1",
"status": "affected",
"version": "15.3.1-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.2",
"status": "affected",
"version": "15.3.2-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.8",
"status": "affected",
"version": "15.1.8-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.3",
"status": "affected",
"version": "15.3.3-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.0",
"status": "affected",
"version": "15.4.0-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.4",
"status": "affected",
"version": "15.3.4-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.5",
"status": "affected",
"version": "15.3.5-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.1",
"status": "affected",
"version": "15.4.1-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.2",
"status": "affected",
"version": "15.4.2-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.3",
"status": "affected",
"version": "15.4.3-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.4",
"status": "affected",
"version": "15.4.4-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.5",
"status": "affected",
"version": "15.4.5-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.6",
"status": "affected",
"version": "15.4.6-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.7",
"status": "affected",
"version": "15.4.7-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.0",
"status": "affected",
"version": "15.5.0-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.1",
"status": "affected",
"version": "15.5.1-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.2",
"status": "affected",
"version": "15.5.2-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.3",
"status": "affected",
"version": "15.5.3-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.4",
"status": "affected",
"version": "15.5.4-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.5",
"status": "affected",
"version": "15.5.5-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.6",
"status": "affected",
"version": "15.5.6-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.7",
"status": "affected",
"version": "15.5.7-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.8",
"status": "affected",
"version": "15.4.8-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.9",
"status": "affected",
"version": "15.1.9-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.5",
"status": "affected",
"version": "15.0.5-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.6",
"status": "affected",
"version": "15.3.6-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.6",
"status": "affected",
"version": "15.2.6-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.8",
"status": "affected",
"version": "15.5.8-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.9",
"status": "affected",
"version": "15.4.9-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.7",
"status": "affected",
"version": "15.3.7-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.7",
"status": "affected",
"version": "15.2.7-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.10",
"status": "affected",
"version": "15.1.10-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.6",
"status": "affected",
"version": "15.0.6-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.5.9",
"status": "affected",
"version": "15.5.9-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.4.10",
"status": "affected",
"version": "15.4.10-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.3.8",
"status": "affected",
"version": "15.3.8-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.2.8",
"status": "affected",
"version": "15.2.8-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.1.11",
"status": "affected",
"version": "15.1.11-canary.0",
"versionType": "semver"
},
{
"lessThan": "15.0.7",
"status": "affected",
"version": "15.0.7-canary.0",
"versionType": "semver"
},
{
"lessThan": "16.1.5",
"status": "affected",
"version": "16.1.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:\n\n1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.\n\n2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.\n\nBoth attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.\n\nTo be affected you must have an application running with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.\n\nStrongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-26T21:43:05.099Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-59472",
"datePublished": "2026-01-26T21:43:05.099Z",
"dateReserved": "2025-09-16T15:00:07.876Z",
"dateUpdated": "2026-01-27T14:54:04.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-55183 (GCVE-0-2025-55183)
Vulnerability from – Published: 2025-12-11 20:04 – Updated: 2026-01-07 16:26
VLAI?
Summary
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
Severity ?
5.3 (Medium)
CWE
- (CWE-502) Deserialization of Untrusted Data. (CWE-497) Exposure of Sensitive System Information to an Unauthorized Actor
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Meta | react-server-dom-webpack |
Affected:
19.0.0 , ≤ 19.0.1
(semver)
Affected: 19.1.0 , ≤ 19.1.2 (semver) Affected: 19.2.0 , ≤ 19.2.1 (semver) |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55183",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-07T16:24:47.971492Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-07T16:26:47.826Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "react-server-dom-webpack",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.1",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.2",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.1",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "react-server-dom-turbopack",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.1",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.2",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.1",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "react-server-dom-parcel",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.1",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.2",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.1",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2025-12-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "(CWE-502) Deserialization of Untrusted Data. (CWE-497) Exposure of Sensitive System Information to an Unauthorized Actor",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-11T20:09:32.286Z",
"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"shortName": "Meta"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.facebook.com/security/advisories/cve-2025-55183"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"assignerShortName": "Meta",
"cveId": "CVE-2025-55183",
"datePublished": "2025-12-11T20:04:48.655Z",
"dateReserved": "2025-08-08T18:21:47.119Z",
"dateUpdated": "2026-01-07T16:26:47.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-55183 (GCVE-0-2025-55183)
Vulnerability from – Published: 2025-12-11 20:04 – Updated: 2026-01-07 16:26
VLAI?
Summary
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
Severity ?
5.3 (Medium)
CWE
- (CWE-502) Deserialization of Untrusted Data. (CWE-497) Exposure of Sensitive System Information to an Unauthorized Actor
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Meta | react-server-dom-webpack |
Affected:
19.0.0 , ≤ 19.0.1
(semver)
Affected: 19.1.0 , ≤ 19.1.2 (semver) Affected: 19.2.0 , ≤ 19.2.1 (semver) |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55183",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-07T16:24:47.971492Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-07T16:26:47.826Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "react-server-dom-webpack",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.1",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.2",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.1",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "react-server-dom-turbopack",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.1",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.2",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.1",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "react-server-dom-parcel",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.1",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.2",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.1",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2025-12-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "(CWE-502) Deserialization of Untrusted Data. (CWE-497) Exposure of Sensitive System Information to an Unauthorized Actor",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-11T20:09:32.286Z",
"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"shortName": "Meta"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.facebook.com/security/advisories/cve-2025-55183"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"assignerShortName": "Meta",
"cveId": "CVE-2025-55183",
"datePublished": "2025-12-11T20:04:48.655Z",
"dateReserved": "2025-08-08T18:21:47.119Z",
"dateUpdated": "2026-01-07T16:26:47.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-55184 (GCVE-0-2025-55184)
Vulnerability from – Published: 2025-12-11 20:05 – Updated: 2025-12-15 16:37
VLAI?
Summary
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Severity ?
7.5 (High)
CWE
- (CWE-502) Deserialization of Untrusted Data. (CWE-400) Uncontrolled Resource Consumption
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Meta | react-server-dom-webpack |
Affected:
19.0.0 , ≤ 19.0.1
(semver)
Affected: 19.1.0 , ≤ 19.1.2 (semver) Affected: 19.2.0 , ≤ 19.2.1 (semver) |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55184",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-15T16:36:27.831763Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-15T16:37:06.708Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/KingHacker353/CVE-2025-55184"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "react-server-dom-webpack",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.1",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.2",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.1",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "react-server-dom-turbopack",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.1",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.2",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.1",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "react-server-dom-parcel",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.1",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.2",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.1",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2025-12-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "(CWE-502) Deserialization of Untrusted Data. (CWE-400) Uncontrolled Resource Consumption",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-11T20:11:26.262Z",
"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"shortName": "Meta"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.facebook.com/security/advisories/cve-2025-55184"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"assignerShortName": "Meta",
"cveId": "CVE-2025-55184",
"datePublished": "2025-12-11T20:05:01.328Z",
"dateReserved": "2025-08-08T18:21:47.119Z",
"dateUpdated": "2025-12-15T16:37:06.708Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-55184 (GCVE-0-2025-55184)
Vulnerability from – Published: 2025-12-11 20:05 – Updated: 2025-12-15 16:37
VLAI?
Summary
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Severity ?
7.5 (High)
CWE
- (CWE-502) Deserialization of Untrusted Data. (CWE-400) Uncontrolled Resource Consumption
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Meta | react-server-dom-webpack |
Affected:
19.0.0 , ≤ 19.0.1
(semver)
Affected: 19.1.0 , ≤ 19.1.2 (semver) Affected: 19.2.0 , ≤ 19.2.1 (semver) |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55184",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-15T16:36:27.831763Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-15T16:37:06.708Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/KingHacker353/CVE-2025-55184"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "react-server-dom-webpack",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.1",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.2",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.1",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "react-server-dom-turbopack",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.1",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.2",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.1",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "react-server-dom-parcel",
"vendor": "Meta",
"versions": [
{
"lessThanOrEqual": "19.0.1",
"status": "affected",
"version": "19.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.1.2",
"status": "affected",
"version": "19.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "19.2.1",
"status": "affected",
"version": "19.2.0",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2025-12-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "(CWE-502) Deserialization of Untrusted Data. (CWE-400) Uncontrolled Resource Consumption",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-11T20:11:26.262Z",
"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"shortName": "Meta"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.facebook.com/security/advisories/cve-2025-55184"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"assignerShortName": "Meta",
"cveId": "CVE-2025-55184",
"datePublished": "2025-12-11T20:05:01.328Z",
"dateReserved": "2025-08-08T18:21:47.119Z",
"dateUpdated": "2025-12-15T16:37:06.708Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
displaying 1 - 10 organizations in total 60