CVE-2025-55184

CVE-2025-55184 is a pre-authentication denial-of-service flaw in the deserialization logic of the React Server Components packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack in versions 19.0.0 through 19.2.1. An attacker triggers it by sending a crafted, unauthenticated HTTP request to any Server Function endpoint, where unsafe deserialization of the payload causes an infinite loop that hangs the server process. Successful attacks cause high availability impact: the affected process stops responding and subsequent HTTP requests are no longer served until the process is restarted, with no expected confidentiality or integrity loss. Any application using React 19 Server Components is affected, including Next.js deployments whose Server Functions rely on these packages. No public proof-of-concept or confirmed in-the-wild exploitation is known for this specific flaw, but the very high EPSS score (66.9% within 30 days, 99th percentile) and ongoing exploitation of related React RSC flaws (React2Shell) indicate elevated risk.

What to do: Inventory all applications using React 19 Server Components (react-server-dom-webpack, -turbopack, -parcel), including Next.js builds that bundle them, and upgrade to a React 19.x release newer than 19.2.1 with the patched packages as soon as available. As an interim mitigation, restrict and rate-limit access to Server Function endpoints and monitor or auto-restart server processes that hang under crafted requests. Prioritize patching given that related React RSC vulnerabilities are already being exploited in the wild.