React Patches Two New Flaws Risking Server-Crashing DoS and Source Code Disclosure

The article reports that two new vulnerabilities in React Server Components have been patched, one potentially causing a server-crashing Denial of Service and the other exposing source code. The High Severity issue, rated CVSS 7.5, is tracked as CVE-2025-55184 and CVE-2025-67779 and can trigger an infinite loop on the server via a specific malicious HTTP request.

This loop is described as CPU-intensive and capable of locking up server resources, with a broad blast radius since it does not require active use of specific server functions to be at risk. The second flaw, CVE-2025-55183 (CVSS 5.3), could allow a Server Function to return its own source code under certain conditions, though exploitation requires a particular coding pattern where a stringified argument is exposed.

Affected versions include 19.0.0 through 19.0.2, 19.1.0 through 19.1.2, and 19.2.0 through 19.2.2, with fixes in 19.0.3, 19.1.4 and 19.2.3, and developers are urged to upgrade immediately. The vulnerabilities affect the same packages as the prior RCE flaw, namely react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.