Deserialization of Untrusted Data in React - CVE-2025-55184
Published: December 12, 2025 / Updated: January 16, 2026
Vulnerability identifier: #VU119891
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2025-55184
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: Facebook Inc.
Affected software:
React
React
Detailed vulnerability description
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can send a specially crafted HTTP request, which can cause an infinite loop and prevent future HTTP requests from being served, leading to a denial of service condition.
The vulnerability affects the following components:
- react-server-dom-webpack (Meta)
- react-server-dom-turbopack (Meta)
- react-server-dom-parcel (Meta)
How to mitigate CVE-2025-55184
Install updates from vendor's website.
Sources
- https://www.facebook.com/security/advisories/cve-2025-55184
- https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
- https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956
- https://github.com/facebook/react/security/advisories/GHSA-7gmr-mq3h-m5h9