New React RSC Vulnerabilities Enable DoS and Source Code Exposure

The React team has released fixes for two new flaws in React Server Components (RSC) that could cause denial-of-service and expose source code, if exploited. The vulnerabilities are CVE-2025-55184 (CVSS 7.5), CVE-2025-67779 (CVSS 7.5) and CVE-2025-55183 (CVSS 5.3); CVE-2025-55184 stems from unsafe deserialization of payloads in HTTP requests to Server Function endpoints and can trigger an infinite loop that hangs the server, while CVE-2025-55183 could leak the source code of a Server Function.

CVE-2025-67779 is described as an incomplete fix for CVE-2025-55184 with the same impact. The issues affect react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack across versions 19.0.0 to 19.2.1 for CVE-2025-55184 and CVE-2025-55183, and 19.0.2, 19.1.3, and 19.2.2 for CVE-2025-67779, with patches available in 19.0.3, 19.1.4 and 19.2.3.

Security researchers RyotaK and Shinsaku Nomura were credited with reporting the two DoS bugs to the Meta Bug Bounty programme, while Andrew MacPherson was acknowledged for reporting the information leak flaw, and users are urged to update promptly in light of ongoing exploration of CVE-2025-55182.