React Server Components - Denial of Service

highseverity

7.5CVSS score

64.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

React Server Components 19.0.0 to 19.2.1 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain an insecure deserialization vulnerability caused by unsafe payload deserialization in Server Function endpoints, letting unauthenticated attackers cause denial of service by hanging the server process.

Impact

Unauthenticated attackers can cause the server to hang indefinitely, resulting in denial of service and preventing legitimate requests.

Fix

Update to the latest version beyond 19.2.1.

How to confirm it

Send: GET /
Positive when: contains(body, "/_next/static/") and status_code == 200
Send: GET {{current_chunk}}
Positive when: compare_versions(react_version, ">= 19.0.0", "<= 19.2.1") and status_code == 200
Send: POST /
Positive when: contains(body, "Server action not found") and contains(content_type, "text/plain") and status_code == 404

Run it with nuclei: nuclei -id CVE-2025-55184 -u <target>

The full check

id: CVE-2025-55184

info:
  name: React Server Components - Denial of Service
  author: DhiyaneshDk
  severity: high
  description: |
    React Server Components 19.0.0 to 19.2.1 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain an insecure deserialization vulnerability caused by unsafe payload deserialization in Server Function endpoints, letting unauthenticated attackers cause denial of service by hanging the server process.
  impact: |
    Unauthenticated attackers can cause the server to hang indefinitely, resulting in denial of service and preventing legitimate requests.
  remediation: |
    Update to the latest version beyond 19.2.1.
  reference:
    - https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183#patched-versions
    - https://www.facebook.com/security/advisories/cve-2025-55184
    - https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2025-55184
    epss-score: 0.66615
    epss-percentile: 0.99294
    cwe-id: CWE-502
  metadata:
    verified: true
    max-request: 3
    vendor: facebook
    product: react
    shodan-query: http.component:"Next.js"
  tags: cve,cve2025,react,nextjs,dos,vkev

flow: |
  http(1);
  for (let chunk of iterate("chunk_path")) {
    set("current_chunk", chunk);
    if (http(2)) {
      http(3);
      break;
    }
  }

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'contains(body, "/_next/static/")'
          - 'status_code == 200'
        condition: and

    extractors:
      - type: regex
        name: chunk_path
        part: body
        internal: true
        group: 1
        regex:
          - '"(/_next/static/[^"]+\.js)"'

  - raw:
      - |
        GET {{current_chunk}} HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'compare_versions(react_version, ">= 19.0.0", "<= 19.2.1")'
          - 'status_code == 200'
        condition: and

    extractors:
      - type: regex
        name: react_version
        part: body
        internal: true
        group: 1
        regex:
          - '\.version;if\("(\d+\.\d+\.\d+)'

  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Accept: text/x-component
        Content-Type: application/x-www-form-urlencoded
        Next-Action: x

        0=["$F1"]&1={"id":"x","bound":null}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "Server action not found")'
          - 'contains(content_type, "text/plain")'
          - 'status_code == 404'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - '"react=" + react_version'

References

Use this check only on systems you are authorised to test. Where the data comes from