CVE

CVE-2025-55184

7.5

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

react-server-dom-webpackreact-server-dom-turbopackreact-server-dom-parcel

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

React Server Components - Denial of Service

React Server Components 19.0.0 to 19.2.1 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain an insecure deserialization vulnerability caused by unsafe payload deserialization in Server Function endpoints, letting unauthenticated attackers cause denial of service by hanging the server process. References: https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183#patched-versions https://www.facebook.com/security/advisories/cve-2025-55184 https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components Remediation: Update to the latest version beyond 19.2.1.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: react-server-dom-webpack

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →