CVE-2025-55184
📋 TL;DR
A pre-authentication denial of service vulnerability in React Server Components allows attackers to send specially crafted HTTP requests to Server Function endpoints, causing infinite loops that hang server processes. This affects React Server Components versions 19.0.0 through 19.2.1, including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages. Any application using these vulnerable versions is susceptible to server unavailability.
💻 Affected Systems
- react-server-dom-parcel
- react-server-dom-turbopack
- react-server-dom-webpack
📦 What is this software?
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
React by Facebook
React by Facebook
React by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Complete server unavailability with process hanging indefinitely, preventing all HTTP requests from being served, potentially requiring manual process termination and server restart.
Likely Case
Targeted denial of service attacks causing service disruption for legitimate users, with server processes becoming unresponsive until restarted.
If Mitigated
Limited impact with proper request filtering and monitoring, though vulnerable systems remain at risk of targeted attacks.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests to Server Function endpoints. Public proof-of-concept code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 19.2.2 or later
Vendor Advisory: https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
Restart Required: Yes
Instructions:
1. Update React Server Components to version 19.2.2 or later. 2. Update package.json dependencies to use patched versions. 3. Run npm update or yarn update. 4. Restart all affected server processes.
🔧 Temporary Workarounds
Request Filtering
allImplement request filtering or rate limiting on Server Function endpoints to block suspicious payloads.
Process Monitoring
allImplement monitoring to detect and restart hung server processes automatically.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all Server Function endpoints
- Deploy Web Application Firewall (WAF) rules to block malicious payload patterns
🔍 How to Verify
Check if Vulnerable:
Check package.json for React Server Components versions 19.0.0 through 19.2.1. Run 'npm list react-server-dom-parcel react-server-dom-turbopack react-server-dom-webpack' to see installed versions.Check Version:
npm list react-server-dom-parcel react-server-dom-turbopack react-server-dom-webpack --depth=0Verify Fix Applied:
Verify installed packages are at version 19.2.2 or later. Test Server Function endpoints with known safe payloads to ensure normal operation.📡 Detection & Monitoring
Log Indicators:
- Unusually long processing times for Server Function requests
- Server process hanging or becoming unresponsive
- Multiple failed requests to Server Function endpoints
Network Indicators:
- Repeated HTTP requests to Server Function endpoints with similar payloads
- Unusual traffic patterns targeting specific endpoints
SIEM Query:
source="application_logs" AND (message="Server Function timeout" OR message="process hang" OR message="infinite loop")