CVE-2025-67779
Unknown
Unknown - Not Provided
BaseFortify
Publication date: 2025-12-12
Last updated on: 2025-12-12
Assigner: Facebook, Inc.
Description
Description
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| react | 19.0.2 | |
| react | 19.1.3 | |
| react | 19.2.2 | |
| vercel | next.js | From 13.3.0 (inc) to 14.2.35 (exc) |
| vercel | next.js | From 15.0.0 (inc) to 15.0.7 (exc) |
| vercel | next.js | From 15.1.0 (inc) to 15.1.11 (exc) |
| vercel | next.js | From 15.2.0 (inc) to 15.2.8 (exc) |
| vercel | next.js | From 15.3.0 (inc) to 15.3.8 (exc) |
| vercel | next.js | From 15.4.0 (inc) to 15.4.10 (exc) |
| vercel | next.js | From 15.5.0 (inc) to 15.5.9 (exc) |
| vercel | next.js | From 16.0.0 (inc) to 16.0.10 (exc) |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 15.6.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
| vercel | next.js | 16.1.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an incomplete fix for a previous issue (CVE-2025-55184) in React Server Components. It allows unsafe deserialization of payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process.
How can this vulnerability impact me? :
The vulnerability can cause a denial of service by making the server process hang in an infinite loop, potentially preventing the server from handling future HTTP requests.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70