cvelistv5 - CVE-2025-67779

CVE-2025-67779 (GCVE-0-2025-67779)

Vulnerability from cvelistv5 – Published: 2025-12-11 23:36 – Updated: 2025-12-12 18:40

Summary

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

(CWE-502) Deserialization of Untrusted Data, (CWE-400) Uncontrolled Resource Consumption

Assigner

Meta

react-server-dom-parcel

Affected: 19.0.2 , ≤ 19.0.2 (semver)
Affected: 19.1.3 , ≤ 19.1.3 (semver)
Affected: 19.2.2 , ≤ 19.2.2 (semver)

	Meta	react-server-dom-turbopack	Affected: 19.0.2 , ≤ 19.0.2 (semver) Affected: 19.1.3 , ≤ 19.1.3 (semver) Affected: 19.2.2 , ≤ 19.2.2 (semver)
	Meta	react-server-dom-webpack	Affected: 19.0.2 , ≤ 19.0.2 (semver) Affected: 19.1.3 , ≤ 19.1.3 (semver) Affected: 19.2.2 , ≤ 19.2.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-67779",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-12T18:39:24.796538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-502",
                "description": "CWE-502 Deserialization of Untrusted Data",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-12T18:40:45.863Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "react-server-dom-parcel",
          "vendor": "Meta",
          "versions": [
            {
              "lessThanOrEqual": "19.0.2",
              "status": "affected",
              "version": "19.0.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "19.1.3",
              "status": "affected",
              "version": "19.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "19.2.2",
              "status": "affected",
              "version": "19.2.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "react-server-dom-turbopack",
          "vendor": "Meta",
          "versions": [
            {
              "lessThanOrEqual": "19.0.2",
              "status": "affected",
              "version": "19.0.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "19.1.3",
              "status": "affected",
              "version": "19.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "19.2.2",
              "status": "affected",
              "version": "19.2.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "react-server-dom-webpack",
          "vendor": "Meta",
          "versions": [
            {
              "lessThanOrEqual": "19.0.2",
              "status": "affected",
              "version": "19.0.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "19.1.3",
              "status": "affected",
              "version": "19.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "19.2.2",
              "status": "affected",
              "version": "19.2.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "(CWE-502) Deserialization of Untrusted Data, (CWE-400) Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-11T23:36:20.699Z",
        "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
        "shortName": "Meta"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.facebook.com/security/advisories/cve-2025-67779"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
    "assignerShortName": "Meta",
    "cveId": "CVE-2025-67779",
    "datePublished": "2025-12-11T23:36:20.699Z",
    "dateReserved": "2025-12-11T22:58:08.827Z",
    "dateUpdated": "2025-12-12T18:40:45.863Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-67779\",\"sourceIdentifier\":\"cve-assign@fb.com\",\"published\":\"2025-12-12T00:15:46.797\",\"lastModified\":\"2025-12-12T18:20:19.773\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cve-assign@fb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:facebook:react:19.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD201828-1BBF-45C9-B769-8C277F2227FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:facebook:react:19.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"23F46EFD-6DF1-400D-B707-6013722D63A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:facebook:react:19.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8B38D46-3F8A-496D-9D1E-60BEAAFA8358\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"13.3.0\",\"versionEndExcluding\":\"14.2.35\",\"matchCriteriaId\":\"6E0DE913-817F-40D2-BC98-0D610CCDE02A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.0.7\",\"matchCriteriaId\":\"7F89ACED-432F-4789-A368-96D4E28DEE34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"15.1.0\",\"versionEndExcluding\":\"15.1.11\",\"matchCriteriaId\":\"99287D38-84D1-470A-96EF-B1D851552139\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"15.2.0\",\"versionEndExcluding\":\"15.2.8\",\"matchCriteriaId\":\"4E4E7989-19E3-44C5-B292-54C73FF3F356\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"15.3.0\",\"versionEndExcluding\":\"15.3.8\",\"matchCriteriaId\":\"78D397D2-B678-4463-85AB-8887554166C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"15.4.0\",\"versionEndExcluding\":\"15.4.10\",\"matchCriteriaId\":\"137455D1-FCE0-4A58-A479-E7CA39EA969D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"15.5.0\",\"versionEndExcluding\":\"15.5.9\",\"matchCriteriaId\":\"7EFB67E0-24A1-4013-A654-C3EEAA2702DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"16.0.0\",\"versionEndExcluding\":\"16.0.10\",\"matchCriteriaId\":\"009539CB-1F6D-446A-B581-1ABC70B10154\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"3ED7F693-8012-4F88-BC71-CF108E20664A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"40EE98AC-754A-4FD9-B51A-9E2674584FD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"13B41C54-AF21-4637-A852-F997635B4E83\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"91B41697-2D70-488D-A5C3-CB9D435560CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"7D43DB84-7BCF-429B-849A-7189EC1922D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"CEC2346B-8DBD-4D53-9866-CFBDD3AACEF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"2BC95097-8CA6-42FE-98D7-F968E37C11B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"4F8FA85C-1200-4FD2-B5D7-906300748BD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"5D0B177B-2A31-48E9-81C7-1024E2452486\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"7CCA01F3-3A14-4450-8A68-B1DA22C685B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"1AB351AE-8C29-4E67-8699-0AAC6B3383E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"14A34D9D-5FA2-434B-836E-3CE63D716CCB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"E8440F05-F32B-4D40-90B7-04BF22107D86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"FB6C6F6D-1EC0-4BD9-97A4-CFDE70DF0C43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"6189BD4C-A3E2-451B-96B2-FF01250E946D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"389EE453-8B07-45DD-BE9C-277C9C5CB156\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"BA4D4638-4734-4B16-87AA-EF4B5D2DDD7A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"D54A2E63-6E0C-4E17-86A8-459B0A7EE00B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"E6136F0A-3010-4BAD-811B-D047CF5E6F64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"525EFA40-B14B-47E9-8FBD-45721A802DB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"69142944-1EC0-4F94-862E-FA7F2E101101\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"30016C06-372D-4F98-84A8-0732CA054970\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"E1536E2B-84EC-46A3-9B6F-026364A9D927\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"5E6F1F60-30E2-407C-8152-EEEB7EFE24CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"3C907301-2C8F-465B-8134-94130E29F5DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"E81C89FD-40CB-471E-9967-90ACDCF79373\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"55E8AEEC-A686-49D6-B298-AEE4E838E769\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"CB0618EC-6A0B-4AC3-BF6D-E51AC84C4E15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"7B27F133-8EB4-4761-A706-DF42D4EB55F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"BF975472-B7E7-4AC8-B834-DA19897A4894\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"48A82613-F3FD-4E89-8E4A-F3F05A616171\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"0D42CA1F-7C21-47C1-8A9C-1015286FCBE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"7C83A4EF-B96F-40EC-BA1F-FE1370AF78AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"C151FDAB-DE34-4A7E-9762-6E99386798BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"53025212-05F0-41FE-81F8-023B1784BB8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"68EAC2B9-32A5-4721-BB35-16D519CD1BBC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"7411EF71-CBEB-4127-935F-3C732A1E22AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"0C4B8930-1B65-4894-AFA8-C323AA7A8292\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"B4977345-BD8C-41C7-9DD7-1E41D6CC6438\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"EFE030A4-5B14-4C2D-B953-E80C98FB26EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"9F616FD4-83BF-4A9A-AFFD-0D3E2544DC7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"00512630-8B88-43B0-9ED3-2B33C64CC9A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"A88EEF11-C7DA-4E2D-A030-FC177E696557\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"BE8453D9-7275-4A5F-8732-F05662FFF2E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"E306B896-9BBB-424B-8D99-7A1A79AEFE9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"ACA87B86-33D5-4BEA-A13D-EEB4922D511E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"77AA0D23-B101-445C-A260-ED3152A93D17\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"7D7DCCF7-FC83-4767-A0C2-C84A8B14F93B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"FD397568-7F1F-4153-AF08-B22D4D3B45F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"984416EF-B121-40CE-B3AD-E22A06BB5844\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"C4B58652-EE24-43CF-8ABE-4A01B2C9938C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"8090CF73-AEA7-43FC-A960-321BED3B1682\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"823164E5-609D-4F24-86A5-E25618FE86A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"E13CD688-63C3-4FFA-9D13-696005F0C155\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"B397B18C-8A7A-4766-9A68-98B26E190A4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"15454C74-5F28-475D-830A-2AE603292301\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"A638BD4D-8CE5-421E-97C3-A56A4F057A50\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"2DB345E3-BAD0-497E-93AE-5E4DC669C192\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"840FEB19-2C66-4004-A488-B90219F8AC05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"C260F966-73D7-43F3-A329-8C558A695821\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"28130A79-39B5-43E8-A690-C8E9C62483F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:-:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"09089CEC-B446-496E-940D-AD4FE4E440ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary0:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"22B740D5-0CF9-45D6-A12A-FE0567276481\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary1:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"256B837F-159D-449B-A748-5E4136E17D21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary10:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"7091E48E-8CD5-41DB-835F-6A3DC82CC10E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary11:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"F074BCE2-16CA-4628-9325-4C1865F71B05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary12:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"EC66102A-F2C4-4069-A7D0-CA1E1961B048\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary13:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"D9AFF756-AD32-4B69-A3C2-CD77BEEDC30D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary14:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"550CC768-2BFF-41D2-B2A9-6332782FAE8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary15:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"65B15DCD-A2F3-445A-85FC-1B35F176FAA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary16:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"6923D356-EF15-4747-877B-74F6B5CFC297\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary17:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"2B1A9FB9-9501-4F29-9535-D21387A668DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary18:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"DA2A5F90-BEC1-4588-BFD6-4D095EAB40A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary2:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"061F871B-F0F9-4166-8D97-3A9F6D234AD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary3:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"2F375E07-2ACB-4FF1-86C7-D499EEA9BD20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary4:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"4540A878-F057-4371-97C8-B286921E7F5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary5:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"F7A5ED68-0BB9-4699-B0F5-C425DC92F8A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary6:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"76CD81F2-69D3-47F0-988E-235A16870511\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary7:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"74EE714B-8E4F-47A0-9C9C-C3A93810ABB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary8:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"1C2E002A-D038-492A-8B83-F5EF658B56ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:16.1.0:canary9:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"F369DF32-1EF0-4342-BFEF-CFC0F485D8B6\"}]}]}],\"references\":[{\"url\":\"https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components\",\"source\":\"cve-assign@fb.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.facebook.com/security/advisories/cve-2025-67779\",\"source\":\"cve-assign@fb.com\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}

NCSC-2025-0394

Vulnerability from csaf_ncscnl - Published: 2025-12-12 09:04 - Updated: 2025-12-12 10:46

Summary

Kwetsbaarheden verholpen in React Server Components

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Meta heeft kwetsbaarheden verholpen in React Server Components Parcel, Turbopack en Webpack.

Interpretaties

De kwetsbaarheden zijn gerelateerd aan onveilige deserialisatie van HTTP-verzoekpayloads, wat kan leiden tot Denial-of-Service-aanvallen en serverhangen. Dit heeft invloed op de beschikbaarheid van applicaties die gebruikmaken van deze versies. Daarnaast is er een informatielek dat kan resulteren in het blootleggen van de broncode van Server Functions onder specifieke omstandigheden. Deze kwetsbaarheden zijn kritiek voor server-side rendering in React-applicaties.

Oplossingen

Meta heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-400

Uncontrolled Resource Consumption

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

CWE-502

Deserialization of Untrusted Data

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Meta heeft kwetsbaarheden verholpen in React Server Components Parcel, Turbopack en Webpack.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden zijn gerelateerd aan onveilige deserialisatie van HTTP-verzoekpayloads, wat kan leiden tot Denial-of-Service-aanvallen en serverhangen. Dit heeft invloed op de beschikbaarheid van applicaties die gebruikmaken van deze versies. Daarnaast is er een informatielek dat kan resulteren in het blootleggen van de broncode van Server Functions onder specifieke omstandigheden. Deze kwetsbaarheden zijn kritiek voor server-side rendering in React-applicaties.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Meta heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive System Information to an Unauthorized Control Sphere",
        "title": "CWE-497"
      },
      {
        "category": "general",
        "text": "Deserialization of Untrusted Data",
        "title": "CWE-502"
      },
      {
        "category": "general",
        "text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
        "title": "CWE-835"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.facebook.com/security/advisories/cve-2025-55183"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.facebook.com/security/advisories/cve-2025-55184"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.facebook.com/security/advisories/cve-2025-67779"
      }
    ],
    "title": "Kwetsbaarheden verholpen in React Server Components",
    "tracking": {
      "current_release_date": "2025-12-12T10:46:34.688189Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2025-0394",
      "initial_release_date": "2025-12-12T09:04:19.324080Z",
      "revision_history": [
        {
          "date": "2025-12-12T09:04:19.324080Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        },
        {
          "date": "2025-12-12T10:46:34.688189Z",
          "number": "1.0.1",
          "summary": "De kwetsbaarheden zitten volgens het React team in onderstaande versies:\n\n- CVE-2025-55184 \u0026 CVE-2025-55183 - 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1\n\n- CVE-2025-67779 - 19.0.2, 19.1.3 and 19.2.2\n\nDe kwetsbaarheden worden in versies 19.0.3, 19.1.4, and 19.2.3 verholpen."
        }
      ],
      "status": "final",
      "version": "1.0.1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "react-server-dom-parcel"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "react-server-dom-turbopack"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "react-server-dom-webpack"
          }
        ],
        "category": "vendor",
        "name": "Meta Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-67779",
      "notes": [
        {
          "category": "description",
          "text": "The fix for CVE-2025-55184 in React Server Components is incomplete, leaving versions 19.0.2, 19.1.3, and 19.2.2 vulnerable to denial of service attacks due to unsafe deserialization of HTTP request payloads.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-67779 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-67779.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2025-67779"
    },
    {
      "cve": "CVE-2025-55183",
      "cwe": {
        "id": "CWE-497",
        "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive System Information to an Unauthorized Control Sphere",
          "title": "CWE-497"
        },
        {
          "category": "other",
          "text": "Deserialization of Untrusted Data",
          "title": "CWE-502"
        },
        {
          "category": "description",
          "text": "A vulnerability in React Server Components allows crafted HTTP requests to expose source code, necessitating immediate updates for affected versions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-55183 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55183.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2025-55183"
    },
    {
      "cve": "CVE-2025-55184",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        },
        {
          "category": "other",
          "text": "Deserialization of Untrusted Data",
          "title": "CWE-502"
        },
        {
          "category": "description",
          "text": "A denial of service vulnerability in specific versions of React Server Components, caused by unsafe deserialization, can lead to server hangs and block future HTTP requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-55184 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55184.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2025-55184"
    }
  ]
}

FKIE_CVE-2025-67779

Vulnerability from fkie_nvd - Published: 2025-12-12 00:15 - Updated: 2025-12-12 15:17

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	cve-assign@fb.com	https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
	cve-assign@fb.com	https://www.facebook.com/security/advisories/cve-2025-67779

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served."
    }
  ],
  "id": "CVE-2025-67779",
  "lastModified": "2025-12-12T15:17:31.973",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "cve-assign@fb.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-12-12T00:15:46.797",
  "references": [
    {
      "source": "cve-assign@fb.com",
      "url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"
    },
    {
      "source": "cve-assign@fb.com",
      "url": "https://www.facebook.com/security/advisories/cve-2025-67779"
    }
  ],
  "sourceIdentifier": "cve-assign@fb.com",
  "vulnStatus": "Undergoing Analysis"
}

GHSA-7GMR-MQ3H-M5H9

Vulnerability from github – Published: 2025-12-12 16:32 – Updated: 2025-12-12 16:32

Summary

Denial of Service Vulnerability in React Server Components

Details

Impact

It was found that the fix to address CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case.

We recommend updating immediately.

The vulnerability exists in versions 19.0.2, 19.1.3, and 19.2.2 of:

These issues are present in the patches published on December 11th, 2025.

Patches

Fixes were back ported to versions 19.0.3, 19.1.4, and 19.2.3.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References

See the blog post for more information and upgrade instructions.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "react-server-dom-parcel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "19.0.2"
            },
            {
              "fixed": "19.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "react-server-dom-parcel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "19.1.3"
            },
            {
              "fixed": "19.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "react-server-dom-parcel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "19.2.2"
            },
            {
              "fixed": "19.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "react-server-dom-turbopack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "19.0.2"
            },
            {
              "fixed": "19.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "react-server-dom-turbopack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "19.1.3"
            },
            {
              "fixed": "19.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "react-server-dom-turbopack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "19.2.2"
            },
            {
              "fixed": "19.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "react-server-dom-webpack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "19.0.2"
            },
            {
              "fixed": "19.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "react-server-dom-webpack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "19.1.3"
            },
            {
              "fixed": "19.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "react-server-dom-webpack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "19.2.2"
            },
            {
              "fixed": "19.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-67779"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-12T16:32:43Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Impact\n\nIt was found that the fix to address [CVE-2025-55184](https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and does not prevent a denial of service attack in a specific case.\n\nWe recommend updating immediately.\n\nThe vulnerability exists in versions 19.0.2, 19.1.3, and 19.2.2 of:\n\n- [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)\n- [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)\n- [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)\n\nThese issues are present in the patches published on December 11th, 2025.\n\n## Patches\n\nFixes were back ported to versions 19.0.3, 19.1.4, and 19.2.3. \n\nIf you are using any of the above packages please upgrade to any of the fixed versions immediately.\n\nIf your app\u2019s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.\n\n## References\n\nSee the [blog post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more information and upgrade instructions.",
  "id": "GHSA-7gmr-mq3h-m5h9",
  "modified": "2025-12-12T16:32:43Z",
  "published": "2025-12-12T16:32:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956"
    },
    {
      "type": "WEB",
      "url": "https://github.com/facebook/react/security/advisories/GHSA-7gmr-mq3h-m5h9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67779"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/facebook/react"
    },
    {
      "type": "WEB",
      "url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Denial of Service Vulnerability in React Server Components"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-67779 (GCVE-0-2025-67779)

NCSC-2025-0394

FKIE_CVE-2025-67779

GHSA-7GMR-MQ3H-M5H9

Impact

Patches

References

Tags

Sightings

Nomenclature