SummaryAI-written · claude-haiku-5-5AI-written · claude-haiku-5-5Written by a language model from the source data on this page. Not reviewed by a person. Generated 29 Oct 2026.
A pre-authentication denial of service flaw exists in Meta's react-server-dom-webpack component of React Server Components (versions 19.0.0 through 19.2.1, including the related react-server-dom-parcel and react-server-dom-turbopack packages), where unsafe deserialization of HTTP request payloads sent to Server Function endpoints can trigger an infinite loop. An unauthenticated remote attacker with network access can send crafted requests that hang the server process and may stop it from serving subsequent HTTP requests, requiring no user interaction and no special configuration.
Official description · CVE.orgSource dataSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. Copied from CVE.org.
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown.Breakdown
72.3 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 4 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
A fix was bypassed or incomplete once on the same day. The latest fix listed for react-server-dom-webpack is 19.2.5.
Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.
This CVECVE-2025-55184A pre-authentication denial of service vulnerability exists in…11 Dec 2025
incomplete fixHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Stated in the CVE textIt was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linked
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSVSourceSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. GitHub Security Advisories and OSV.
3 packages in 1 ecosystem. Main package: react-server-dom-webpack.