ID:12228 - Exploit for Deserialization of Untrusted Data in React - CVE-2025-55184

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can send a specially crafted HTTP request, which can cause an infinite loop and prevent future HTTP requests from being served, leading to a denial of service condition. 

The vulnerability affects the following components:

- react-server-dom-webpack (Meta) 
- react-server-dom-turbopack (Meta) 
- react-server-dom-parcel (Meta) 

Remediation