Vulnerability Intelligence Report
CVE-2025-67779
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
No Active Exploit Signals
CVSS Base Score
7.5
HIGH
Exploitability:3.9
Impact Score:3.6
EPSS Probability:18.88%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-502 ↗(CWE-502) Deserialization of Untrusted Data, (CWE-400) Uncontrolled Resource Consumption
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Meta | react-server-dom-parcel | 19.0.2 <= 19.0.2 (affected), 19.1.3 <= 19.1.3 (affected), 19.2.2 <= 19.2.2 (affected) |
| Meta | react-server-dom-turbopack | 19.0.2 <= 19.0.2 (affected), 19.1.3 <= 19.1.3 (affected), 19.2.2 <= 19.2.2 (affected) |
| Meta | react-server-dom-webpack | 19.0.2 <= 19.0.2 (affected), 19.1.3 <= 19.1.3 (affected), 19.2.2 <= 19.2.2 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
18.880%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Meta Platforms, Inc. · Vendor · USA |
| Reserved | 2025-12-11T22:58:08 |
| Published | 2025-12-11T23:36:20 |
| Last Updated | 2025-12-12T18:40:45 |
Community Chatter & Buzz