CVE-2025-55184 Scanner
CVE-2025-55184 Scanner - Denial of Service vulnerability in React Server Components
Used 3.1k times · 5.9k assets checked · domain, subdomain, ipv4
CVE
CVE-2025-55184
7.5
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
react-server-dom-webpackreact-server-dom-turbopackreact-server-dom-parcel
Updated Sep 18, 2026View on NVD →
S4E scanner
CVE history: react-server-dom-webpack
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →