Skip to content
fr Sign in
7.5 High

CVE-2025-55184 A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0,…

Description

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

Affected products and versions

Product Affected versions Fixed in
react-server-dom-webpack 19.2 19.2.0 → 19.2.1 No fix stated
react-server-dom-webpack 19.1 19.1.0 → 19.1.2 No fix stated
react-server-dom-webpack 19.0 19.0.0 → 19.0.1 No fix stated
react-server-dom-turbopack 19.2 19.2.0 → 19.2.1 No fix stated
react-server-dom-turbopack 19.1 19.1.0 → 19.1.2 No fix stated
react-server-dom-turbopack 19.0 19.0.0 → 19.0.1 No fix stated
react-server-dom-parcel 19.2 19.2.0 → 19.2.1 No fix stated
react-server-dom-parcel 19.1 19.1.0 → 19.1.2 No fix stated
react-server-dom-parcel 19.0 19.0.0 → 19.0.1 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of react-server-dom-webpack

The 8 CVEs of react-server-dom-webpack →
CVE-2026-44907 A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function… 7.5 High CVE-2026-23870 A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function… 7.5 High CVE-2026-23869 A denial of service vulnerability exists in React Server Components, affecting the following packages:… 7.5 High CVE-2026-23864 Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages:… 7.5 High
Track this CVE