{"id":"CVE-2025-55184","published":"2025-12-11T20:05:01Z","modified":"2025-12-15T16:37:06Z","title":"A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0…","vendor":"Meta","product":"react-server-dom-webpack","tier":"core","eol":null,"affectedVersions":[{"vendor":"Meta","product":"react-server-dom-webpack","versions":[">= 19.0.0, <= 19.0.1",">= 19.1.0, <= 19.1.2",">= 19.2.0, <= 19.2.1"]},{"vendor":"Meta","product":"react-server-dom-turbopack","versions":[">= 19.0.0, <= 19.0.1",">= 19.1.0, <= 19.1.2",">= 19.2.0, <= 19.2.1"]},{"vendor":"Meta","product":"react-server-dom-parcel","versions":[">= 19.0.0, <= 19.0.1",">= 19.1.0, <= 19.1.2",">= 19.2.0, <= 19.2.1"]}],"description":{"text":"A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.","provenance":"source","from":"CVE.org"},"summary":{"text":"A pre-authentication denial of service flaw exists in Meta's react-server-dom-webpack component of React Server Components (versions 19.0.0 through 19.2.1, including the related react-server-dom-parcel and react-server-dom-turbopack packages), where unsafe deserialization of HTTP request payloads sent to Server Function endpoints can trigger an infinite loop. An unauthenticated remote attacker with network access can send crafted requests that hang the server process and may stop it from serving subsequent HTTP requests, requiring no user interaction and no special configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:59Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.66615,"percentile":0.99285,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-04-15","exploitedFirstSeen":"2026-04-15","ransomware":false,"evidence":[{"url":"https://www.f5.com/labs/articles/azure-hosted-scanning-cluster-launches-wordpress-webshell-discovery-campaign","date":"2026-04-15"},{"url":"https://www.f5.com/labs/articles/cve-2024-44000-litespeed-cache-account-takeover-ranks-in-june-s-top-threats","date":"2026-07-20"},{"url":"https://www.f5.com/labs/articles/attackers-target-ai-development-platform-langflow","date":"2026-10-06"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":8,"pulses":[{"name":"Attackers Target AI Development Platform Langflow","url":"https://otx.alienvault.com/pulse/6ac71ccaf3871c21505cc54c","created":"2026-10-08"},{"name":"Attackers Target AI Development Platform Langflow","url":"https://otx.alienvault.com/pulse/6ac5f1632c72bc95740deede","created":"2026-10-07"},{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - April 2026","url":"https://otx.alienvault.com/pulse/6a04aeed763730d81a39cece","created":"2026-05-13"},{"name":"Weekly Threat Bulletin – January 28th, 2026","url":"https://otx.alienvault.com/pulse/697ae2da32ab2efc29be04aa","created":"2026-01-29"},{"name":"Weekly Threat Bulletin – January 28th, 2026","url":"https://otx.alienvault.com/pulse/697a0fb2c327ef769cb46467","created":"2026-01-28"},{"name":"Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)","url":"https://otx.alienvault.com/pulse/6940e587f54477fc54ec53e0","created":"2025-12-16"},{"name":"Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)","url":"https://otx.alienvault.com/pulse/693dbc770dda63b6789c82b1","created":"2025-12-13"},{"name":"Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)","url":"https://otx.alienvault.com/pulse/693d41e31912ac329def62a6","created":"2025-12-13"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.facebook.com/security/advisories/cve-2025-55184","tags":["x_refsource_CONFIRM"]},{"url":"https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/KingHacker353/CVE-2025-55184","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"npm","package":"react-server-dom-parcel","vulnerableRanges":[">=19.0.0, <19.0.2",">=19.1.0, <19.1.3",">=19.2.0, <19.2.2"],"patched":["19.0.2","19.1.3","19.2.2"],"from":["GHSA-2m3v-v2m8-q956"],"provenance":"source"},{"ecosystem":"npm","package":"react-server-dom-turbopack","vulnerableRanges":[">=19.0.0, <19.0.2",">=19.1.0, <19.1.3",">=19.2.0, <19.2.2"],"patched":["19.0.2","19.1.3","19.2.2"],"from":["GHSA-2m3v-v2m8-q956"],"provenance":"source"},{"ecosystem":"npm","package":"react-server-dom-webpack","vulnerableRanges":[">=19.0.0, <19.0.2",">=19.1.0, <19.1.3",">=19.2.0, <19.2.2"],"patched":["19.0.2","19.1.3","19.2.2"],"from":["GHSA-2m3v-v2m8-q956"],"provenance":"source"}],"advisories":[{"id":"GHSA-2m3v-v2m8-q956","url":"https://github.com/advisories/GHSA-2m3v-v2m8-q956","severity":"HIGH","ecosystem":"npm","package":"react-server-dom-parcel","vulnerableRanges":[">=19.0.0, <19.0.2"],"patched":["19.0.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-2m3v-v2m8-q956","url":"https://github.com/advisories/GHSA-2m3v-v2m8-q956","severity":"HIGH","ecosystem":"npm","package":"react-server-dom-turbopack","vulnerableRanges":[">=19.0.0, <19.0.2"],"patched":["19.0.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-2m3v-v2m8-q956","url":"https://github.com/advisories/GHSA-2m3v-v2m8-q956","severity":"HIGH","ecosystem":"npm","package":"react-server-dom-webpack","vulnerableRanges":[">=19.0.0, <19.0.2"],"patched":["19.0.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-2m3v-v2m8-q956","url":"https://github.com/advisories/GHSA-2m3v-v2m8-q956","severity":"HIGH","ecosystem":"npm","package":"react-server-dom-parcel","vulnerableRanges":[">=19.1.0, <19.1.3"],"patched":["19.1.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-2m3v-v2m8-q956","url":"https://github.com/advisories/GHSA-2m3v-v2m8-q956","severity":"HIGH","ecosystem":"npm","package":"react-server-dom-parcel","vulnerableRanges":[">=19.2.0, <19.2.2"],"patched":["19.2.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-2m3v-v2m8-q956","url":"https://github.com/advisories/GHSA-2m3v-v2m8-q956","severity":"HIGH","ecosystem":"npm","package":"react-server-dom-turbopack","vulnerableRanges":[">=19.1.0, <19.1.3"],"patched":["19.1.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-2m3v-v2m8-q956","url":"https://github.com/advisories/GHSA-2m3v-v2m8-q956","severity":"HIGH","ecosystem":"npm","package":"react-server-dom-turbopack","vulnerableRanges":[">=19.2.0, <19.2.2"],"patched":["19.2.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-2m3v-v2m8-q956","url":"https://github.com/advisories/GHSA-2m3v-v2m8-q956","severity":"HIGH","ecosystem":"npm","package":"react-server-dom-webpack","vulnerableRanges":[">=19.1.0, <19.1.3"],"patched":["19.1.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-2m3v-v2m8-q956","url":"https://github.com/advisories/GHSA-2m3v-v2m8-q956","severity":"HIGH","ecosystem":"npm","package":"react-server-dom-webpack","vulnerableRanges":[">=19.2.0, <19.2.2"],"patched":["19.2.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-202877","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202877","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":8,"skipped":1,"earliest":"2025-12-12","earliestUrl":"https://github.com/hans362/CVE-2025-55184-poc","repos":[{"name":"cybertechajju/CVE-2025-55184-POC-Expolit","url":"https://github.com/cybertechajju/CVE-2025-55184-POC-Expolit","stars":22,"created":"2025-12-13"},{"name":"ejpir/CVE-2025-55184","url":"https://github.com/ejpir/CVE-2025-55184","stars":7,"created":"2025-12-12"},{"name":"hans362/CVE-2025-55184-poc","url":"https://github.com/hans362/CVE-2025-55184-poc","stars":3,"created":"2025-12-12"},{"name":"KkHackingLearning/CVE-2025-55184_Testing","url":"https://github.com/KkHackingLearning/CVE-2025-55184_Testing","stars":2,"created":"2025-12-13"},{"name":"KingHacker353/CVE-2025-55184","url":"https://github.com/KingHacker353/CVE-2025-55184","stars":1,"created":"2025-12-14"}]},"nuclei":[{"id":"CVE-2025-55184","name":"React Server Components - Denial of Service","severity":"high","path":"http/cves/2025/CVE-2025-55184.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55184.yaml"}],"first":{"date":"2025-12-12","source":"PoC-in-GitHub","url":"https://github.com/hans362/CVE-2025-55184-poc"},"provenance":"source"},"exploitRefs":["https://github.com/KingHacker353/CVE-2025-55184"],"flow":[],"timeline":[{"date":"2025-12-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-55184","provenance":"source"},{"date":"2025-12-12","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/hans362/CVE-2025-55184-poc","provenance":"source"},{"date":"2026-04-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.f5.com/labs/articles/azure-hosted-scanning-cluster-launches-wordpress-webshell-discovery-campaign","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":72.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 198 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.86,"detail":"percentile 0.9929"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 8 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-meta-react-server-dom-webpack-cve-2025-55184","children":[{"from":"CVE-2025-55184","to":"CVE-2025-67779","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case.","from":"CVE.org","in":"CVE-2025-67779"},{"kind":"osv-related","provenance":"source","id":"GHSA-7gmr-mq3h-m5h9","via":"reference","url":"https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956"},{"kind":"version-step","provenance":"source","package":"npm:react-server-dom-webpack","fromFixed":"19.0.2","toFixed":"19.0.3","daysApart":0},{"kind":"version-step","provenance":"source","package":"npm:react-server-dom-turbopack","fromFixed":"19.0.2","toFixed":"19.0.3","daysApart":0},{"kind":"similar","provenance":"machine","score":0.61,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2025-55182","published":"2025-12-03","fixed":"19.2.1","kev":true,"link":{"from":"CVE-2025-55182","to":"CVE-2025-55184","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:react-server-dom-webpack","fromFixed":"19.0.1","toFixed":"19.0.2","daysApart":8},{"kind":"version-step","provenance":"source","package":"npm:react-server-dom-turbopack","fromFixed":"19.0.1","toFixed":"19.0.2","daysApart":8},{"kind":"similar","provenance":"machine","score":0.66,"basis":"same package + description similarity"}]}},{"cve":"CVE-2025-55183","published":"2025-12-11","fixed":"19.2.2","kev":false},{"cve":"CVE-2025-55184","published":"2025-12-11","fixed":"19.2.2","kev":false},{"cve":"CVE-2025-67779","published":"2025-12-11","fixed":"19.2.3","kev":false},{"cve":"CVE-2026-23864","published":"2026-01-26","fixed":"19.2.4","kev":false},{"cve":"CVE-2026-23869","published":"2026-04-08","fixed":"19.2.5","kev":false}],"package":"npm:react-server-dom-webpack"}}