CVE-2025-67779
📋 TL;DR
This vulnerability allows attackers to send specially crafted HTTP requests to React Server Components Server Function endpoints, causing unsafe deserialization that triggers an infinite loop. This leads to denial of service by hanging the server process and preventing future requests. Applications using React Server Components versions 19.0.2, 19.1.3, or 19.2.2 are affected.
💻 Affected Systems
- React Server Components
📦 What is this software?
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
Next.js by Vercel
React by Facebook
React by Facebook
React by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Complete server unavailability due to infinite loop consuming all CPU resources, requiring manual process termination and restart.
Likely Case
Partial or complete denial of service affecting specific endpoints or the entire server application.
If Mitigated
Minimal impact with proper request validation and monitoring in place.
🎯 Exploit Status
Exploitation requires sending crafted HTTP requests to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 19.0.3, 19.1.4, 19.2.3 or later
Vendor Advisory: https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
Restart Required: Yes
Instructions:
1. Update React Server Components to patched version. 2. Update package.json dependencies. 3. Run npm update or yarn update. 4. Restart server application.
🔧 Temporary Workarounds
Rate Limiting
allImplement request rate limiting on Server Function endpoints
Input Validation
allAdd strict input validation for all Server Function endpoint payloads
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block suspicious payload patterns
- Monitor server processes for abnormal CPU usage and implement automatic restart thresholds
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for React Server Components version 19.0.2, 19.1.3, or 19.2.2Check Version:
npm list react-server-components or check package.jsonVerify Fix Applied:
Verify React Server Components version is 19.0.3, 19.1.4, 19.2.3 or later📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes
- Server process hanging
- Request timeouts on Server Function endpoints
Network Indicators:
- Repeated HTTP requests to Server Function endpoints with unusual payloads
SIEM Query:
source="application.logs" AND ("high cpu" OR "process hang" OR "request timeout") AND endpoint="*server-function*"