It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

Denial of Service vulnerability in React Server Components has been disclosed which could impact performance on a server.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not
    prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and
    19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function
    endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP
    requests from being served. (CVE-2025-67779)

Multiple Node.js React Server Components packages are affected by a denial of service vulnerability.
The following Node.js packages and versions are affected:

  - react-server-dom-webpack 19.0.2, 19.1.3, 19.2.2
  - react-server-dom-parcel 19.0.2, 19.1.3, 19.2.2
  - react-server-dom-turbopack 19.0.2, 19.1.3, 19.2.2

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
436373	SCA: security update for react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack (GHSA-7gmr-mq3h-m5h9)	Tenable Cloud Security	SCA Checks	Local	high
436373	SCA: security update for react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack (GHSA-7gmr-mq3h-m5h9)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
278532	Node.js React Server Components Denial of Service (CVE-2025-67779)	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2025-67779

high

Tenable Plugins

high

high

high