# CVE-2025-55184: A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.

Source: https://junglewise.ai/threats/cve-2025-55184-meta-react-server-components-denial-of-service-via-unsafe  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-55184 · Severity: high · CVSS 7.5 · Published 2025-12-11

React Server Components, a framework feature used by developers to build interactive web applications, contains a vulnerability that allows unauthenticated attackers to crash the application server. An attacker can send specially crafted HTTP requests that cause the server to enter an infinite loop, consuming CPU and preventing legitimate users from accessing the application.

## Quick answers

**Is CVE-2025-55184 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-55184 being exploited in the wild.

**How severe is CVE-2025-55184?** High severity, with a CVSS score of 7.5, published 11 December 2025.

**Which products and versions are affected?** Meta react-server-dom-webpack 19.0.0–19.0.1, 19.1.0–19.1.2, 19.2.0–19.2.1; Meta react-server-dom-parcel 19.0.0–19.0.1, 19.1.0–19.1.2, 19.2.0–19.2.1; Meta react-server-dom-turbopack 19.0.0–19.0.1, 19.1.0–19.1.2, 19.2.0–19.2.1.

**Is there a fix for CVE-2025-55184?** A patch was published on 2025-12-11: Patches released for versions 19.0.2, 19.1.3, and 19.2.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-55184 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-55184?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the deserialization logic of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages. When processing HTTP requests to Server Function endpoints, the framework unsafely deserializes request payloads without adequate validation, allowing an attacker to construct input that causes an infinite loop during deserialization. The attack requires no authentication or user interaction and is accessible over the network to any Server Function endpoint. A successful exploit results in server-side denial of service—the process hangs, CPU spikes, or out-of-memory conditions occur, rendering the application unavailable. The vulnerability affects versions 19.0.0–19.0.1, 19.1.0–19.1.2, and 19.2.0–19.2.1. Patches backported to 19.0.2, 19.1.3, and 19.2.2 remediate the issue by preventing the infinite loop during deserialization. Applications that do not use a server or do not support React Server Components are not affected.

## Affected products

- Meta react-server-dom-webpack 19.0.0–19.0.1, 19.1.0–19.1.2, 19.2.0–19.2.1
- Meta react-server-dom-parcel 19.0.0–19.0.1, 19.1.0–19.1.2, 19.2.0–19.2.1
- Meta react-server-dom-turbopack 19.0.0–19.0.1, 19.1.0–19.1.2, 19.2.0–19.2.1

## Identifiers

- CVE-2025-55184
- GHSA-2m3v-v2m8-q956

## Timeline

- 2025-12-11: disclosed: Vulnerability publicly disclosed as CVE-2025-55184 and GHSA-2m3v-v2m8-q956
- 2025-12-11: patched: Patches released for versions 19.0.2, 19.1.3, and 19.2.2

## References

- [https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956](https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956)
- [https://github.com/facebook/react](https://github.com/facebook/react)
- [https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components)
- [https://www.facebook.com/security/advisories/cve-2025-55184](https://www.facebook.com/security/advisories/cve-2025-55184)