Deserialization of untrusted data in Meta react-server-dom-webpack
Priority HIGH 75CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution, Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502 and CWE-400.
Summary
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.66615 99th percentileScored 2026-11-07
Fix Fixed react-server-dom-parcel (npm): 19.0.2, 19.1.3, 19.2.2react-server-dom-turbopack (npm): 19.0.2, 19.1.3, 19.2.2+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Meta | react-server-dom-webpack | 19.0.0 – 19.0.1; 19.1.0 – 19.1.2; 19.2.0 – 19.2.1 | — | No fix listed | CNA |
| Meta | react-server-dom-turbopack | 19.0.0 – 19.0.1; 19.1.0 – 19.1.2; 19.2.0 – 19.2.1 | — | No fix listed | CNA |
| Meta | react-server-dom-parcel | 19.0.0 – 19.0.1; 19.1.0 – 19.1.2; 19.2.0 – 19.2.1 | — | No fix listed | CNA |
| — | react-server-dom-parcel (npm) | 19.0.0 to before 19.0.2 | 19.0.2 | Patch available | GHSA-2m3v-v2m8-q956 |
| — | react-server-dom-turbopack (npm) | 19.0.0 to before 19.0.2 | 19.0.2 | Patch available | GHSA-2m3v-v2m8-q956 |
| — | react-server-dom-webpack (npm) | 19.0.0 to before 19.0.2 | 19.0.2 | Patch available | GHSA-2m3v-v2m8-q956 |
| — | react-server-dom-parcel (npm) | 19.1.0 to before 19.1.3 | 19.1.3 | Patch available | GHSA-2m3v-v2m8-q956 |
| — | react-server-dom-parcel (npm) | 19.2.0 to before 19.2.2 | 19.2.2 | Patch available | GHSA-2m3v-v2m8-q956 |
| — | react-server-dom-turbopack (npm) | 19.1.0 to before 19.1.3 | 19.1.3 | Patch available | GHSA-2m3v-v2m8-q956 |
| — | react-server-dom-turbopack (npm) | 19.2.0 to before 19.2.2 | 19.2.2 | Patch available | GHSA-2m3v-v2m8-q956 |
| — | react-server-dom-webpack (npm) | 19.1.0 to before 19.1.3 | 19.1.3 | Patch available | GHSA-2m3v-v2m8-q956 |
| — | react-server-dom-webpack (npm) | 19.2.0 to before 19.2.2 | 19.2.2 | Patch available | GHSA-2m3v-v2m8-q956 |
- react-server-dom-webpack VendorMeta Affected 19.0.0 – 19.0.1; 19.1.0 – 19.1.2; 19.2.0 – 19.2.1 Fixed in — No fix listed CNA
- react-server-dom-turbopack VendorMeta Affected 19.0.0 – 19.0.1; 19.1.0 – 19.1.2; 19.2.0 – 19.2.1 Fixed in — No fix listed CNA
- react-server-dom-parcel VendorMeta Affected 19.0.0 – 19.0.1; 19.1.0 – 19.1.2; 19.2.0 – 19.2.1 Fixed in — No fix listed CNA
- react-server-dom-parcel (npm) Vendor— Affected 19.0.0 to before 19.0.2 Fixed in 19.0.2 Patch available GHSA-2m3v-v2m8-q956
- react-server-dom-turbopack (npm) Vendor— Affected 19.0.0 to before 19.0.2 Fixed in 19.0.2 Patch available GHSA-2m3v-v2m8-q956
- react-server-dom-webpack (npm) Vendor— Affected 19.0.0 to before 19.0.2 Fixed in 19.0.2 Patch available GHSA-2m3v-v2m8-q956
- react-server-dom-parcel (npm) Vendor— Affected 19.1.0 to before 19.1.3 Fixed in 19.1.3 Patch available GHSA-2m3v-v2m8-q956
- react-server-dom-parcel (npm) Vendor— Affected 19.2.0 to before 19.2.2 Fixed in 19.2.2 Patch available GHSA-2m3v-v2m8-q956
- react-server-dom-turbopack (npm) Vendor— Affected 19.1.0 to before 19.1.3 Fixed in 19.1.3 Patch available GHSA-2m3v-v2m8-q956
- react-server-dom-turbopack (npm) Vendor— Affected 19.2.0 to before 19.2.2 Fixed in 19.2.2 Patch available GHSA-2m3v-v2m8-q956
- react-server-dom-webpack (npm) Vendor— Affected 19.1.0 to before 19.1.3 Fixed in 19.1.3 Patch available GHSA-2m3v-v2m8-q956
- react-server-dom-webpack (npm) Vendor— Affected 19.2.0 to before 19.2.2 Fixed in 19.2.2 Patch available GHSA-2m3v-v2m8-q956
CPE configurations NVD · 83
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:* | 19.0.0 to before 19.0.2; 19.1.0 to before 19.1.3; 19.2.0 to before 19.2.2 | Vulnerable | Meta |
| cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* | 13.3.0 to before 14.2.35; 15.0.0 to before 15.0.7; 15.1.0 to before 15.1.11; 15.2.0 to before 15.2.8; 15.3.0 to before 15.3.8; 15.4.0 to before 15.4.10; 15.5.0 to before 15.5.9; 16.0.0 to before 16.0.10 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:* | 15.6.0 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:* | 15.6.0 canary0 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:* | 15.6.0 canary1 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:* | 15.6.0 canary10 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:* | 15.6.0 canary11 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:* | 15.6.0 canary12 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:* | 15.6.0 canary13 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:* | 15.6.0 canary14 | Vulnerable | vercel |
- cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:* Versions 19.0.0 to before 19.0.2; 19.1.0 to before 19.1.3; 19.2.0 to before 19.2.2 Vulnerable ·Meta
- cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions 13.3.0 to before 14.2.35; 15.0.0 to before 15.0.7; 15.1.0 to before 15.1.11; 15.2.0 to before 15.2.8; 15.3.0 to before 15.3.8; 15.4.0 to before 15.4.10; 15.5.0 to before 15.5.9; 16.0.0 to before 16.0.10 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:* Versions 15.6.0 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:* Versions 15.6.0 canary0 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:* Versions 15.6.0 canary1 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:* Versions 15.6.0 canary10 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:* Versions 15.6.0 canary11 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:* Versions 15.6.0 canary12 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:* Versions 15.6.0 canary13 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:* Versions 15.6.0 canary14 Vulnerable ·vercel
Show 73 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:* | 15.6.0 canary15 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:* | 15.6.0 canary16 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:* | 15.6.0 canary17 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:* | 15.6.0 canary18 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:* | 15.6.0 canary19 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:* | 15.6.0 canary2 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:* | 15.6.0 canary20 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:* | 15.6.0 canary21 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:* | 15.6.0 canary22 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:* | 15.6.0 canary23 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:* | 15.6.0 canary24 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:* | 15.6.0 canary25 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:* | 15.6.0 canary26 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:* | 15.6.0 canary27 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:* | 15.6.0 canary28 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:* | 15.6.0 canary29 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:* | 15.6.0 canary3 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:* | 15.6.0 canary30 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:* | 15.6.0 canary31 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:* | 15.6.0 canary32 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:* | 15.6.0 canary33 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:* | 15.6.0 canary34 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:* | 15.6.0 canary35 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:* | 15.6.0 canary36 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:* | 15.6.0 canary37 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:* | 15.6.0 canary38 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:* | 15.6.0 canary39 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:* | 15.6.0 canary4 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:* | 15.6.0 canary40 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:* | 15.6.0 canary41 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:* | 15.6.0 canary42 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:* | 15.6.0 canary43 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:* | 15.6.0 canary44 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:* | 15.6.0 canary45 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:* | 15.6.0 canary46 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:* | 15.6.0 canary47 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:* | 15.6.0 canary48 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:* | 15.6.0 canary49 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:* | 15.6.0 canary5 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:* | 15.6.0 canary50 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:* | 15.6.0 canary51 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:* | 15.6.0 canary52 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:* | 15.6.0 canary53 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:* | 15.6.0 canary54 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:* | 15.6.0 canary55 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:* | 15.6.0 canary56 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:* | 15.6.0 canary57 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:* | 15.6.0 canary58 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:* | 15.6.0 canary59 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:* | 15.6.0 canary6 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:* | 15.6.0 canary7 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:* | 15.6.0 canary8 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:* | 15.6.0 canary9 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:-:*:*:*:node.js:*:* | 16.1.0 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary0:*:*:*:node.js:*:* | 16.1.0 canary0 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary1:*:*:*:node.js:*:* | 16.1.0 canary1 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary10:*:*:*:node.js:*:* | 16.1.0 canary10 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary11:*:*:*:node.js:*:* | 16.1.0 canary11 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary12:*:*:*:node.js:*:* | 16.1.0 canary12 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary13:*:*:*:node.js:*:* | 16.1.0 canary13 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary14:*:*:*:node.js:*:* | 16.1.0 canary14 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary15:*:*:*:node.js:*:* | 16.1.0 canary15 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary16:*:*:*:node.js:*:* | 16.1.0 canary16 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary17:*:*:*:node.js:*:* | 16.1.0 canary17 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary18:*:*:*:node.js:*:* | 16.1.0 canary18 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary2:*:*:*:node.js:*:* | 16.1.0 canary2 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary3:*:*:*:node.js:*:* | 16.1.0 canary3 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary4:*:*:*:node.js:*:* | 16.1.0 canary4 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary5:*:*:*:node.js:*:* | 16.1.0 canary5 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary6:*:*:*:node.js:*:* | 16.1.0 canary6 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary7:*:*:*:node.js:*:* | 16.1.0 canary7 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary8:*:*:*:node.js:*:* | 16.1.0 canary8 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary9:*:*:*:node.js:*:* | 16.1.0 canary9 | Vulnerable | vercel |
- cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:* Versions 15.6.0 canary15 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:* Versions 15.6.0 canary16 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:* Versions 15.6.0 canary17 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:* Versions 15.6.0 canary18 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:* Versions 15.6.0 canary19 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:* Versions 15.6.0 canary2 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:* Versions 15.6.0 canary20 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:* Versions 15.6.0 canary21 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:* Versions 15.6.0 canary22 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:* Versions 15.6.0 canary23 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:* Versions 15.6.0 canary24 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:* Versions 15.6.0 canary25 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:* Versions 15.6.0 canary26 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:* Versions 15.6.0 canary27 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:* Versions 15.6.0 canary28 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:* Versions 15.6.0 canary29 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:* Versions 15.6.0 canary3 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:* Versions 15.6.0 canary30 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:* Versions 15.6.0 canary31 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:* Versions 15.6.0 canary32 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:* Versions 15.6.0 canary33 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:* Versions 15.6.0 canary34 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:* Versions 15.6.0 canary35 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:* Versions 15.6.0 canary36 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:* Versions 15.6.0 canary37 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:* Versions 15.6.0 canary38 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:* Versions 15.6.0 canary39 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:* Versions 15.6.0 canary4 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:* Versions 15.6.0 canary40 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:* Versions 15.6.0 canary41 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:* Versions 15.6.0 canary42 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:* Versions 15.6.0 canary43 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:* Versions 15.6.0 canary44 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:* Versions 15.6.0 canary45 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:* Versions 15.6.0 canary46 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:* Versions 15.6.0 canary47 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:* Versions 15.6.0 canary48 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:* Versions 15.6.0 canary49 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:* Versions 15.6.0 canary5 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:* Versions 15.6.0 canary50 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:* Versions 15.6.0 canary51 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:* Versions 15.6.0 canary52 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:* Versions 15.6.0 canary53 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:* Versions 15.6.0 canary54 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:* Versions 15.6.0 canary55 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:* Versions 15.6.0 canary56 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:* Versions 15.6.0 canary57 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:* Versions 15.6.0 canary58 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:* Versions 15.6.0 canary59 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:* Versions 15.6.0 canary6 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:* Versions 15.6.0 canary7 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:* Versions 15.6.0 canary8 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:* Versions 15.6.0 canary9 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:-:*:*:*:node.js:*:* Versions 16.1.0 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary0:*:*:*:node.js:*:* Versions 16.1.0 canary0 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary1:*:*:*:node.js:*:* Versions 16.1.0 canary1 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary10:*:*:*:node.js:*:* Versions 16.1.0 canary10 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary11:*:*:*:node.js:*:* Versions 16.1.0 canary11 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary12:*:*:*:node.js:*:* Versions 16.1.0 canary12 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary13:*:*:*:node.js:*:* Versions 16.1.0 canary13 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary14:*:*:*:node.js:*:* Versions 16.1.0 canary14 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary15:*:*:*:node.js:*:* Versions 16.1.0 canary15 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary16:*:*:*:node.js:*:* Versions 16.1.0 canary16 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary17:*:*:*:node.js:*:* Versions 16.1.0 canary17 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary18:*:*:*:node.js:*:* Versions 16.1.0 canary18 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary2:*:*:*:node.js:*:* Versions 16.1.0 canary2 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary3:*:*:*:node.js:*:* Versions 16.1.0 canary3 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary4:*:*:*:node.js:*:* Versions 16.1.0 canary4 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary5:*:*:*:node.js:*:* Versions 16.1.0 canary5 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary6:*:*:*:node.js:*:* Versions 16.1.0 canary6 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary7:*:*:*:node.js:*:* Versions 16.1.0 canary7 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary8:*:*:*:node.js:*:* Versions 16.1.0 canary8 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary9:*:*:*:node.js:*:* Versions 16.1.0 canary9 Vulnerable ·vercel
Remediation
- Fix · GHSA-2m3v-v2m8-q956 react-server-dom-parcel (npm) Fixed in 19.0.2 Advisory →
- Fix · GHSA-2m3v-v2m8-q956 react-server-dom-turbopack (npm) Fixed in 19.0.2 Advisory →
- Fix · GHSA-2m3v-v2m8-q956 react-server-dom-webpack (npm) Fixed in 19.0.2 Advisory →
- Fix · GHSA-2m3v-v2m8-q956 react-server-dom-parcel (npm) Fixed in 19.1.3 Advisory →
- Fix · GHSA-2m3v-v2m8-q956 react-server-dom-parcel (npm) Fixed in 19.2.2 Advisory →
- Fix · GHSA-2m3v-v2m8-q956 react-server-dom-turbopack (npm) Fixed in 19.1.3 Advisory →
- Fix · GHSA-2m3v-v2m8-q956 react-server-dom-turbopack (npm) Fixed in 19.2.2 Advisory →
- Fix · GHSA-2m3v-v2m8-q956 react-server-dom-webpack (npm) Fixed in 19.1.3 Advisory →
- Fix · GHSA-2m3v-v2m8-q956 react-server-dom-webpack (npm) Fixed in 19.2.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 8 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Trusted Artifact Signer
- streams for Apache Kafka 2
- streams for Apache Kafka 3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-55184
- 2026-10-03 Alias added: GHSA-2m3v-v2m8-q956
References
Advisory 3
More Meta React vulnerabilities
- TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
- TI-2025-34862 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1MEDIUM 5.3
- TI-2025-41449 Uncontrolled resource consumption in Meta react-server-dom-parcel CVSS 3.1HIGH 7.5
- TI-2026-19225 Uncontrolled resource consumption in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
- TI-2018-04665 Cross-site scripting in Meta react-dom CVSS 3.1MEDIUM 6.1
Sources
- CVE-2025-55184 · CVE Program
- CVE-2025-55184 · NVD
- FIRST EPSS
- GHSA-2m3v-v2m8-q956 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-55184 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences