7.5
High
CVE-2025-67779 It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a…
Description
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| react-server-dom-parcel | 19.2.2 | No fix stated |
| react-server-dom-parcel | 19.1.3 | No fix stated |
| react-server-dom-parcel | 19.0.2 | No fix stated |
| react-server-dom-turbopack | 19.2.2 | No fix stated |
| react-server-dom-turbopack | 19.1.3 | No fix stated |
| react-server-dom-turbopack | 19.0.2 | No fix stated |
| react-server-dom-webpack | 19.2.2 | No fix stated |
| react-server-dom-webpack | 19.1.3 | No fix stated |
| react-server-dom-webpack | 19.0.2 | No fix stated |
References
- www.facebook.com www.facebook.com
- react.dev react.dev
Timeline
- Published
- Last modified
Other CVEs of react-server-dom-parcel
The 8 CVEs of react-server-dom-parcel →
CVE-2026-44907
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function…
7.5
High
CVE-2026-23870
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function…
7.5
High
CVE-2026-23869
A denial of service vulnerability exists in React Server Components, affecting the following packages:…
7.5
High
CVE-2026-23864
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages:…
7.5
High