Executive brief
React Server Components, a framework feature used by developers to build interactive web applications, contains a vulnerability that allows unauthenticated attackers to crash the application server. An attacker can send specially crafted HTTP requests that cause the server to enter an infinite loop, consuming CPU and preventing legitimate users from accessing the application.
Technical details
The vulnerability exists in the deserialization logic of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages. When processing HTTP requests to Server Function endpoints, the framework unsafely deserializes request payloads without adequate validation, allowing an attacker to construct input that causes an infinite loop during deserialization. The attack requires no authentication or user interaction and is accessible over the network to any Server Function endpoint. A successful exploit results in server-side denial of service—the process hangs, CPU spikes, or out-of-memory conditions occur, rendering the application unavailable. The vulnerability affects versions 19.0.0–19.0.1, 19.1.0–19.1.2, and 19.2.0–19.2.1. Patches backported to 19.0.2, 19.1.3, and 19.2.2 remediate the issue by preventing the infinite loop during deserialization. Applications that do not use a server or do not support React Server Components are not affected.
Affected products
- Meta react-server-dom-webpack 19.0.0–19.0.1, 19.1.0–19.1.2, 19.2.0–19.2.1
- Meta react-server-dom-parcel 19.0.0–19.0.1, 19.1.0–19.1.2, 19.2.0–19.2.1
- Meta react-server-dom-turbopack 19.0.0–19.0.1, 19.1.0–19.1.2, 19.2.0–19.2.1
Timeline
- 2025-12-11: disclosed: Vulnerability publicly disclosed as CVE-2025-55184 and GHSA-2m3v-v2m8-q956
- 2025-12-11: patched: Patches released for versions 19.0.2, 19.1.3, and 19.2.2