CVE-2025-67779

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-67779", "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "state": "PUBLISHED", "assignerShortName": "Meta", "dateReserved": "2025-12-11T22:58:08.827Z", "datePublished": "2025-12-11T23:36:20.699Z", "dateUpdated": "2025-12-12T18:40:45.863Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "react-server-dom-parcel", "vendor": "Meta", "versions": [{"lessThanOrEqual": "19.0.2", "status": "affected", "version": "19.0.2", "versionType": "semver"}, {"lessThanOrEqual": "19.1.3", "status": "affected", "version": "19.1.3", "versionType": "semver"}, {"lessThanOrEqual": "19.2.2", "status": "affected", "version": "19.2.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "react-server-dom-turbopack", "vendor": "Meta", "versions": [{"lessThanOrEqual": "19.0.2", "status": "affected", "version": "19.0.2", "versionType": "semver"}, {"lessThanOrEqual": "19.1.3", "status": "affected", "version": "19.1.3", "versionType": "semver"}, {"lessThanOrEqual": "19.2.2", "status": "affected", "version": "19.2.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "react-server-dom-webpack", "vendor": "Meta", "versions": [{"lessThanOrEqual": "19.0.2", "status": "affected", "version": "19.0.2", "versionType": "semver"}, {"lessThanOrEqual": "19.1.3", "status": "affected", "version": "19.1.3", "versionType": "semver"}, {"lessThanOrEqual": "19.2.2", "status": "affected", "version": "19.2.2", "versionType": "semver"}]}], "dateAssigned": "2025-12-11T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served."}], "problemTypes": [{"descriptions": [{"description": "(CWE-502) Deserialization of Untrusted Data, (CWE-400) Uncontrolled Resource Consumption", "lang": "en"}]}], "providerMetadata": {"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "Meta", "dateUpdated": "2025-12-11T23:36:20.699Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.facebook.com/security/advisories/cve-2025-67779"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-502", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-12T18:39:24.796538Z", "id": "CVE-2025-67779", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T18:40:45.863Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-67779", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T18:39:24.796538Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T18:40:06.175Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Meta", "product": "react-server-dom-parcel", "versions": [{"status": "affected", "version": "19.0.2", "versionType": "semver", "lessThanOrEqual": "19.0.2"}, {"status": "affected", "version": "19.1.3", "versionType": "semver", "lessThanOrEqual": "19.1.3"}, {"status": "affected", "version": "19.2.2", "versionType": "semver", "lessThanOrEqual": "19.2.2"}], "defaultStatus": "unaffected"}, {"vendor": "Meta", "product": "react-server-dom-turbopack", "versions": [{"status": "affected", "version": "19.0.2", "versionType": "semver", "lessThanOrEqual": "19.0.2"}, {"status": "affected", "version": "19.1.3", "versionType": "semver", "lessThanOrEqual": "19.1.3"}, {"status": "affected", "version": "19.2.2", "versionType": "semver", "lessThanOrEqual": "19.2.2"}], "defaultStatus": "unaffected"}, {"vendor": "Meta", "product": "react-server-dom-webpack", "versions": [{"status": "affected", "version": "19.0.2", "versionType": "semver", "lessThanOrEqual": "19.0.2"}, {"status": "affected", "version": "19.1.3", "versionType": "semver", "lessThanOrEqual": "19.1.3"}, {"status": "affected", "version": "19.2.2", "versionType": "semver", "lessThanOrEqual": "19.2.2"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.facebook.com/security/advisories/cve-2025-67779", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components", "tags": ["x_refsource_CONFIRM"]}], "dateAssigned": "2025-12-11T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "(CWE-502) Deserialization of Untrusted Data, (CWE-400) Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "Meta", "dateUpdated": "2025-12-11T23:36:20.699Z"}}}, "cveMetadata": {"cveId": "CVE-2025-67779", "state": "PUBLISHED", "dateUpdated": "2025-12-12T18:40:45.863Z", "dateReserved": "2025-12-11T22:58:08.827Z", "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "datePublished": "2025-12-11T23:36:20.699Z", "assignerShortName": "Meta"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "react-server-dom-parcel", "vendor": "Meta", "versions": [{"lessThanOrEqual": "19.0.2", "status": "affected", "version": "19.0.2", "versionType": "semver"}, {"lessThanOrEqual": "19.1.3", "status": "affected", "version": "19.1.3", "versionType": "semver"}, {"lessThanOrEqual": "19.2.2", "status": "affected", "version": "19.2.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "react-server-dom-turbopack", "vendor": "Meta", "versions": [{"lessThanOrEqual": "19.0.2", "status": "affected", "version": "19.0.2", "versionType": "semver"}, {"lessThanOrEqual": "19.1.3", "status": "affected", "version": "19.1.3", "versionType": "semver"}, {"lessThanOrEqual": "19.2.2", "status": "affected", "version": "19.2.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "react-server-dom-webpack", "vendor": "Meta", "versions": [{"lessThanOrEqual": "19.0.2", "status": "affected", "version": "19.0.2", "versionType": "semver"}, {"lessThanOrEqual": "19.1.3", "status": "affected", "version": "19.1.3", "versionType": "semver"}, {"lessThanOrEqual": "19.2.2", "status": "affected", "version": "19.2.2", "versionType": "semver"}]}], "source": "cve-assign@fb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:facebook:react:19.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "FD201828-1BBF-45C9-B769-8C277F2227FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:react:19.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "23F46EFD-6DF1-400D-B707-6013722D63A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:react:19.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "E8B38D46-3F8A-496D-9D1E-60BEAAFA8358", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "6E0DE913-817F-40D2-BC98-0D610CCDE02A", "versionEndExcluding": "14.2.35", "versionStartIncluding": "13.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "7F89ACED-432F-4789-A368-96D4E28DEE34", "versionEndExcluding": "15.0.7", "versionStartIncluding": "15.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "99287D38-84D1-470A-96EF-B1D851552139", "versionEndExcluding": "15.1.11", "versionStartIncluding": "15.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "4E4E7989-19E3-44C5-B292-54C73FF3F356", "versionEndExcluding": "15.2.8", "versionStartIncluding": "15.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "78D397D2-B678-4463-85AB-8887554166C9", "versionEndExcluding": "15.3.8", "versionStartIncluding": "15.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "137455D1-FCE0-4A58-A479-E7CA39EA969D", "versionEndExcluding": "15.4.10", "versionStartIncluding": "15.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "7EFB67E0-24A1-4013-A654-C3EEAA2702DD", "versionEndExcluding": "15.5.9", "versionStartIncluding": "15.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "009539CB-1F6D-446A-B581-1ABC70B10154", "versionEndExcluding": "16.0.10", "versionStartIncluding": "16.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*", "matchCriteriaId": "3ED7F693-8012-4F88-BC71-CF108E20664A", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*", "matchCriteriaId": "40EE98AC-754A-4FD9-B51A-9E2674584FD9", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*", "matchCriteriaId": "13B41C54-AF21-4637-A852-F997635B4E83", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*", "matchCriteriaId": "91B41697-2D70-488D-A5C3-CB9D435560CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*", "matchCriteriaId": "7D43DB84-7BCF-429B-849A-7189EC1922D0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*", "matchCriteriaId": "CEC2346B-8DBD-4D53-9866-CFBDD3AACEF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*", "matchCriteriaId": "2BC95097-8CA6-42FE-98D7-F968E37C11B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*", "matchCriteriaId": "4F8FA85C-1200-4FD2-B5D7-906300748BD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*", "matchCriteriaId": "5D0B177B-2A31-48E9-81C7-1024E2452486", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*", "matchCriteriaId": "7CCA01F3-3A14-4450-8A68-B1DA22C685B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*", "matchCriteriaId": "1AB351AE-8C29-4E67-8699-0AAC6B3383E2", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*", "matchCriteriaId": "14A34D9D-5FA2-434B-836E-3CE63D716CCB", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*", "matchCriteriaId": "E8440F05-F32B-4D40-90B7-04BF22107D86", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*", "matchCriteriaId": "FB6C6F6D-1EC0-4BD9-97A4-CFDE70DF0C43", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*", "matchCriteriaId": "6189BD4C-A3E2-451B-96B2-FF01250E946D", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*", "matchCriteriaId": "389EE453-8B07-45DD-BE9C-277C9C5CB156", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*", "matchCriteriaId": "BA4D4638-4734-4B16-87AA-EF4B5D2DDD7A", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*", "matchCriteriaId": "D54A2E63-6E0C-4E17-86A8-459B0A7EE00B", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*", "matchCriteriaId": "E6136F0A-3010-4BAD-811B-D047CF5E6F64", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*", "matchCriteriaId": "525EFA40-B14B-47E9-8FBD-45721A802DB6", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*", "matchCriteriaId": "69142944-1EC0-4F94-862E-FA7F2E101101", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*", "matchCriteriaId": "30016C06-372D-4F98-84A8-0732CA054970", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*", "matchCriteriaId": "E1536E2B-84EC-46A3-9B6F-026364A9D927", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*", "matchCriteriaId": "5E6F1F60-30E2-407C-8152-EEEB7EFE24CB", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:*", "matchCriteriaId": "3C907301-2C8F-465B-8134-94130E29F5DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:*", "matchCriteriaId": "E81C89FD-40CB-471E-9967-90ACDCF79373", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:*", "matchCriteriaId": "55E8AEEC-A686-49D6-B298-AEE4E838E769", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:*", "matchCriteriaId": "CB0618EC-6A0B-4AC3-BF6D-E51AC84C4E15", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:*", "matchCriteriaId": "7B27F133-8EB4-4761-A706-DF42D4EB55F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:*", "matchCriteriaId": "BF975472-B7E7-4AC8-B834-DA19897A4894", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:*", "matchCriteriaId": "48A82613-F3FD-4E89-8E4A-F3F05A616171", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:*", "matchCriteriaId": "0D42CA1F-7C21-47C1-8A9C-1015286FCBE2", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:*", "matchCriteriaId": "7C83A4EF-B96F-40EC-BA1F-FE1370AF78AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:*", "matchCriteriaId": "C151FDAB-DE34-4A7E-9762-6E99386798BF", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:*", "matchCriteriaId": "53025212-05F0-41FE-81F8-023B1784BB8C", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:*", "matchCriteriaId": "68EAC2B9-32A5-4721-BB35-16D519CD1BBC", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:*", "matchCriteriaId": "7411EF71-CBEB-4127-935F-3C732A1E22AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:*", "matchCriteriaId": "0C4B8930-1B65-4894-AFA8-C323AA7A8292", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:*", "matchCriteriaId": "B4977345-BD8C-41C7-9DD7-1E41D6CC6438", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:*", "matchCriteriaId": "EFE030A4-5B14-4C2D-B953-E80C98FB26EE", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:*", "matchCriteriaId": "9F616FD4-83BF-4A9A-AFFD-0D3E2544DC7E", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:*", "matchCriteriaId": "00512630-8B88-43B0-9ED3-2B33C64CC9A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:*", "matchCriteriaId": "A88EEF11-C7DA-4E2D-A030-FC177E696557", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:*", "matchCriteriaId": "BE8453D9-7275-4A5F-8732-F05662FFF2E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:*", "matchCriteriaId": "E306B896-9BBB-424B-8D99-7A1A79AEFE9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:*", "matchCriteriaId": "ACA87B86-33D5-4BEA-A13D-EEB4922D511E", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:*", "matchCriteriaId": "77AA0D23-B101-445C-A260-ED3152A93D17", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:*", "matchCriteriaId": "7D7DCCF7-FC83-4767-A0C2-C84A8B14F93B", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:*", "matchCriteriaId": "FD397568-7F1F-4153-AF08-B22D4D3B45F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:*", "matchCriteriaId": "984416EF-B121-40CE-B3AD-E22A06BB5844", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:*", "matchCriteriaId": "C4B58652-EE24-43CF-8ABE-4A01B2C9938C", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:*", "matchCriteriaId": "8090CF73-AEA7-43FC-A960-321BED3B1682", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:*", "matchCriteriaId": "823164E5-609D-4F24-86A5-E25618FE86A7", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:*", "matchCriteriaId": "E13CD688-63C3-4FFA-9D13-696005F0C155", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:*", "matchCriteriaId": "B397B18C-8A7A-4766-9A68-98B26E190A4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:*", "matchCriteriaId": "15454C74-5F28-475D-830A-2AE603292301", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:*", "matchCriteriaId": "A638BD4D-8CE5-421E-97C3-A56A4F057A50", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:*", "matchCriteriaId": "2DB345E3-BAD0-497E-93AE-5E4DC669C192", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:*", "matchCriteriaId": "840FEB19-2C66-4004-A488-B90219F8AC05", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:*", "matchCriteriaId": "C260F966-73D7-43F3-A329-8C558A695821", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:*", "matchCriteriaId": "28130A79-39B5-43E8-A690-C8E9C62483F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:-:*:*:*:node.js:*:*", "matchCriteriaId": "09089CEC-B446-496E-940D-AD4FE4E440ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary0:*:*:*:node.js:*:*", "matchCriteriaId": "22B740D5-0CF9-45D6-A12A-FE0567276481", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary1:*:*:*:node.js:*:*", "matchCriteriaId": "256B837F-159D-449B-A748-5E4136E17D21", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary10:*:*:*:node.js:*:*", "matchCriteriaId": "7091E48E-8CD5-41DB-835F-6A3DC82CC10E", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary11:*:*:*:node.js:*:*", "matchCriteriaId": "F074BCE2-16CA-4628-9325-4C1865F71B05", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary12:*:*:*:node.js:*:*", "matchCriteriaId": "EC66102A-F2C4-4069-A7D0-CA1E1961B048", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary13:*:*:*:node.js:*:*", "matchCriteriaId": "D9AFF756-AD32-4B69-A3C2-CD77BEEDC30D", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary14:*:*:*:node.js:*:*", "matchCriteriaId": "550CC768-2BFF-41D2-B2A9-6332782FAE8B", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary15:*:*:*:node.js:*:*", "matchCriteriaId": "65B15DCD-A2F3-445A-85FC-1B35F176FAA1", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary16:*:*:*:node.js:*:*", "matchCriteriaId": "6923D356-EF15-4747-877B-74F6B5CFC297", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary17:*:*:*:node.js:*:*", "matchCriteriaId": "2B1A9FB9-9501-4F29-9535-D21387A668DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary18:*:*:*:node.js:*:*", "matchCriteriaId": "DA2A5F90-BEC1-4588-BFD6-4D095EAB40A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary2:*:*:*:node.js:*:*", "matchCriteriaId": "061F871B-F0F9-4166-8D97-3A9F6D234AD0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary3:*:*:*:node.js:*:*", "matchCriteriaId": "2F375E07-2ACB-4FF1-86C7-D499EEA9BD20", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary4:*:*:*:node.js:*:*", "matchCriteriaId": "4540A878-F057-4371-97C8-B286921E7F5D", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary5:*:*:*:node.js:*:*", "matchCriteriaId": "F7A5ED68-0BB9-4699-B0F5-C425DC92F8A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary6:*:*:*:node.js:*:*", "matchCriteriaId": "76CD81F2-69D3-47F0-988E-235A16870511", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary7:*:*:*:node.js:*:*", "matchCriteriaId": "74EE714B-8E4F-47A0-9C9C-C3A93810ABB3", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary8:*:*:*:node.js:*:*", "matchCriteriaId": "1C2E002A-D038-492A-8B83-F5EF658B56ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:16.1.0:canary9:*:*:*:node.js:*:*", "matchCriteriaId": "F369DF32-1EF0-4342-BFEF-CFC0F485D8B6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served."}, {"lang": "es", "value": "Se descubri\u00f3 que la correcci\u00f3n que aborda CVE-2025-55184 en React Server Components era incompleta y no previene un ataque de denegaci\u00f3n de servicio en un caso espec\u00edfico. Las versiones 19.0.2, 19.1.3 y 19.2.2 de React Server Components est\u00e1n afectadas, permitiendo la deserializaci\u00f3n insegura de cargas \u00fatiles de solicitudes HTTP a los puntos finales de funci\u00f3n de servidor. Esto puede causar un bucle infinito que cuelga el proceso del servidor y puede impedir que futuras solicitudes HTTP sean atendidas."}], "id": "CVE-2025-67779", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "cve-assign@fb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67779", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-12T18:39:24.796538Z", "version": "2.0.3"}}]}, "published": "2025-12-12T00:15:46.797", "references": [{"source": "cve-assign@fb.com", "tags": ["Vendor Advisory"], "url": "https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"}, {"source": "cve-assign@fb.com", "tags": ["Vendor Advisory"], "url": "https://www.facebook.com/security/advisories/cve-2025-67779"}], "sourceIdentifier": "cve-assign@fb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-502"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "next: React Server Components: Denial of Service via Unsafe Deserialization", "id": "2421678", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421678"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-502", "details": ["It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.", "A flaw was found in React Server Components. This vulnerability allows a denial of service via unsafe deserialization of payloads from HTTP (Hypertext Transfer Protocol) requests to Server Function endpoints. A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service. \nThis CVE has been issued as a complete fix for CVE-2025-55184 which was incomplete with initial fix."], "name": "CVE-2025-67779", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "dotnet7.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Not affected", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Not affected", "package_name": "rhelai3/disk-image-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Not affected", "package_name": "rhtas/rekor-search-ui-rhel9", "product_name": "Red Hat Trusted Artifact Signer"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Not affected", "package_name": "com.github.streamshub-console", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Not affected", "package_name": "com.github.streamshub-console", "product_name": "streams for Apache Kafka 3"}], "public_date": "2025-12-11T23:36:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-67779\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-67779\nhttps://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components\nhttps://www.facebook.com/security/advisories/cve-2025-67779"], "statement": "It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and did not fully prevent denial of service attacks in all payload types. A complete fix has been issued under this CVE-2025-67779.\n```\nAdditionally, no Red Hat software includes the directly affected React Server Components packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack). However, the reference implementation of React Server Components is used by other projects such as Next.js. The packages listed here include Next.js as a dependency, but our analysis indicates that they are not affected by the vulnerability as they do not use the App Router functionality that exposes endpoints serving the vulnerable protocol.\n```", "threat_severity": "Important"}

{"created": "2025-12-12T08:48:36.607874+00:00", "updated": "2025-12-12T08:48:36.607899+00:00", "vendors": ["facebook", "facebook$PRODUCT$react-server-dom-parcel", "facebook$PRODUCT$react-server-dom-turbopack", "facebook$PRODUCT$react-server-dom-webpack"]}