CVE-2025-55184: 
React Server Components vulnerability analysis and mitigation

CVE-2025-55184 is a pre-authentication denial of service (DoS) vulnerability in React Server Components (RSC) caused by unsafe deserialization of HTTP request payloads sent to Server Function endpoints. It affects React packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack in versions 19.0.0–19.0.1, 19.1.0–19.1.2, and 19.2.0–19.2.1. The vulnerability was disclosed on December 11, 2025, alongside a related source code exposure flaw (CVE-2025-55183), and patches were published the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Meta Advisory).

The root cause is classified as CWE-502 (Deserialization of Untrusted Data) and CWE-400 (Uncontrolled Resource Consumption). The vulnerable code in the RSC server-side renderer unsafely deserializes attacker-controlled payloads from HTTP POST requests directed at Server Function (Server Actions) endpoints without adequate input validation or recursion depth limits. A specially crafted payload — such as a deeply nested or self-referential structure — triggers an infinite loop during deserialization, causing the Node.js server process to hang indefinitely and become unable to serve further requests. No authentication is required, and the attack complexity is low, making it trivially exploitable over the network. Multiple public PoC repositories and a Nuclei detection template have been published (GitHub Advisory, react.dev Blog).

Successful exploitation causes the server process to enter an infinite loop, effectively hanging the application and preventing all subsequent HTTP requests from being processed — a complete availability loss for the affected service. Applications built on Next.js or other frameworks using React Server Components with Server Actions enabled are at risk. There is no confidentiality or integrity impact from this specific CVE; however, it was disclosed alongside CVE-2025-55183 (source code exposure), and both vulnerabilities together represent a significant attack surface for React 19-based applications (GitHub Advisory, Cloudflare Blog).

Multiple public proof-of-concept repositories exist on GitHub (e.g., KingHacker353/CVE-2025-55184, Tarekhshaikh13/CVE-2025-55184, cybertechajju/CVE-2025-55184-POC-Expolit), and Nuclei detection templates have been contributed to ProjectDiscovery's template library. The EPSS score is approximately 15.8% (Feedly data) to 41.2% (GitHub Advisory, 97th percentile), indicating elevated exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog, and while widespread exploitation of the related React2Shell (CVE-2025-55182) has been attributed to nation-state actors including Chinese and Iranian groups, specific in-the-wild exploitation of CVE-2025-55184 has not been independently confirmed as of the time of this report (GitHub Advisory, Cloudflare Blog, SecurityWeek).

1. Reconnaissance: Identify internet-facing applications using React Server Components with Server Actions enabled. Use tools like Shodan, Censys, or the react-rsc-vuln-scanner npm package to find Next.js or other RSC-based applications running vulnerable React versions (19.0.0–19.0.1, 19.1.0–19.1.2, 19.2.0–19.2.1).
2. Identify Server Function endpoints: Locate Server Action endpoints, typically exposed as HTTP POST routes that accept React Flight protocol payloads (e.g., paths handled by react-server-dom-webpack or similar bundler plugins).
3. Craft malicious payload: Construct a deeply nested, circular, or self-referential deserialization payload in the React Flight wire format that will trigger infinite recursion during the server-side deserialization process.
4. Send the request: Submit the crafted payload via an unauthenticated HTTP POST request to the Server Function endpoint. No session token or authentication header is required.
5. Achieve DoS: The server process enters an infinite loop processing the malicious payload, consuming all available CPU, hanging the Node.js event loop, and preventing any further HTTP requests from being served — effectively taking the application offline (GitHub Advisory, react.dev Blog).

• Network: Unexpected or repeated unauthenticated HTTP POST requests to Server Action endpoints (e.g., paths ending in action handlers or RSC-specific routes); unusually large or malformed request bodies sent to these endpoints; sudden spike in inbound POST traffic from a single or distributed source.
• Process: Node.js server process consuming 100% CPU with no corresponding increase in legitimate traffic; server process becoming unresponsive or timing out; child processes of the Node.js runtime hanging indefinitely.
• Logs: Web server or application logs showing POST requests to Server Function endpoints with abnormally large or deeply nested JSON/binary payloads; requests that never complete (no response logged); error logs showing stack overflow or maximum call stack size exceeded errors in the RSC deserialization path.
• Availability: Application health checks failing; load balancer reporting backend as unhealthy; sudden drop in successful HTTP response rates coinciding with the anomalous POST requests (Cloudflare Blog, Qualys ThreatProtect).

React has released patched versions: 19.0.2, 19.1.3, and 19.2.2 for all three affected packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack). Organizations should upgrade immediately to one of these fixed versions. For Next.js users, patched versions are available across the 14.x and 15.x branches (e.g., 14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9). If immediate patching is not possible, consider deploying a WAF rule to block or rate-limit POST requests to Server Action endpoints, or temporarily disabling Server Actions. Applications that do not use React Server Components or Server Actions are not affected (GitHub Advisory, react.dev Blog, Next.js Security).

The React team published an official blog post and Meta issued a security advisory on December 11, 2025, urging immediate upgrades (react.dev Blog). Vercel, Netlify, Deno, and Cloudflare all published platform-specific advisories and mitigations within hours of disclosure (Vercel Changelog, Cloudflare Blog). The vulnerability received significant coverage from The Hacker News, The Register, CyberScoop, and Cybersecurity Dive, with The Register noting it as part of a broader "worst week" for React/Next.js security. The security community on social media (Bluesky, Mastodon, Reddit) was highly active, with researchers publishing PoC code, Nuclei templates, and scanner tools within 24 hours of disclosure. Canadian Centre for Cyber Security (CCCS) issued advisory AV25-834, and AHNLAB published threat analysis, reflecting broad government and vendor concern (Canadian CCCS, Akamai Blog).