Deserialization of Untrusted Data in React - CVE-2025-55184

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can send a specially crafted HTTP request, which can cause an infinite loop and prevent future HTTP requests from being served, leading to a denial of service condition. 

The vulnerability affects the following components:

- react-server-dom-webpack (Meta) 
- react-server-dom-turbopack (Meta) 
- react-server-dom-parcel (Meta) 

Affected software

How to mitigate CVE-2025-55184

Links to Public Exploits and PoC-codes

• Exploit #12308 - CVE-2025-55184_Testing (January 16, 2026)
• Exploit #12228 - CVE-2025-55184-poc (January 4, 2026)
• Exploit #12227 - react-server-cve-lab (January 4, 2026)

External References

• https://www.facebook.com/security/advisories/cve-2025-55184
• https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
• https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956
• https://github.com/facebook/react/security/advisories/GHSA-7gmr-mq3h-m5h9

Related Security Bulletins

• Multiple vulnerabilities in Facebook React
• Denial of service in Next.js App Router
• Multiple vulnerabilities in IBM Security QRadar Analyst Workflow for IBM QRadar SIEM
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM QRadar Pre-Validation App