CVE-2025-55184: high-severity vulnerability in Meta react-server-dom-parcel
Published · Updated
90Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 7.5epss 67%
from disclosure to weapon1 days
Published on NVDDec 11
1st PoC+1d
VulnCheck+125d
exploitation probability
67%top 1% of all CVEs
observed exploitation
yesVulnCheck
7 public exploit(s)
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Not affected
8 products (32 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux AI (RHEL AI) 3 · and others 3
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Meta · react-server-dom-parcelMeta · react-server-dom-turbopackMeta · react-server-dom-webpackpublic PoCs found — 7
vulncheckvulncheck.com/xdb/e684fa3ad42dunverifiedvulncheckvulncheck.com/xdb/05dd7c5f28e6unverifiedvulncheckvulncheck.com/xdb/b2e6ecda338aunverifiedvulncheckvulncheck.com/xdb/43ad577fa095unverifiedvulncheckvulncheck.com/xdb/d94ca152fa0eunverifiedvulncheckvulncheck.com/xdb/61b3af9acdc6unverifiedvulncheckvulncheck.com/xdb/b46aeedcd294unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Meta react-server-dom-parcel
In the same product, most dangerous first.