CVE-2025-67779highCWE-400CWE-502

CVE-2025-67779: fallo de gravedad alta en Meta react-server-dom-parcel

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear react-server-dom-parcel+ Monitorear react-server-dom-turbopack

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

26Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 20%
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
Meta · react-server-dom-parcelMeta · react-server-dom-turbopackMeta · react-server-dom-webpack
CVEs relacionadas — Meta react-server-dom-parcel

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-55182CRITICALCVE-2025-55182EPSS 99.7%KEVCVE-2025-55184HIGHCVE-2025-55184EPSS 66.6%CVE-2025-55183MEDIUMCVE-2025-55183EPSS 64.2%CVE-2026-23864HIGHCVE-2026-23864EPSS 2.6%CVE-2026-23869HIGHCVE-2026-23869EPSS 1.6%CVE-2026-23870HIGHCVE-2026-23870EPSS 1.5%