Uncontrolled resource consumption in Meta react-server-dom-parcel
Priority MEDIUM 57CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service, Code execution
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400 and CWE-502.
Summary
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.19986 97th percentileScored 2026-11-07
Fix Fixed react-server-dom-parcel (npm): 19.0.3, 19.1.4, 19.2.3react-server-dom-turbopack (npm): 19.0.3, 19.1.4, 19.2.3+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Meta | react-server-dom-parcel | 19.0.2 – 19.0.2; 19.1.3 – 19.1.3; 19.2.2 – 19.2.2 | — | No fix listed | CNA |
| Meta | react-server-dom-turbopack | 19.0.2 – 19.0.2; 19.1.3 – 19.1.3; 19.2.2 – 19.2.2 | — | No fix listed | CNA |
| Meta | react-server-dom-webpack | 19.0.2 – 19.0.2; 19.1.3 – 19.1.3; 19.2.2 – 19.2.2 | — | No fix listed | CNA |
| — | react-server-dom-parcel (npm) | 19.0.2 to before 19.0.3 | 19.0.3 | Patch available | GHSA-7gmr-mq3h-m5h9 |
| — | react-server-dom-parcel (npm) | 19.1.3 to before 19.1.4 | 19.1.4 | Patch available | GHSA-7gmr-mq3h-m5h9 |
| — | react-server-dom-parcel (npm) | 19.2.2 to before 19.2.3 | 19.2.3 | Patch available | GHSA-7gmr-mq3h-m5h9 |
| — | react-server-dom-turbopack (npm) | 19.0.2 to before 19.0.3 | 19.0.3 | Patch available | GHSA-7gmr-mq3h-m5h9 |
| — | react-server-dom-turbopack (npm) | 19.1.3 to before 19.1.4 | 19.1.4 | Patch available | GHSA-7gmr-mq3h-m5h9 |
| — | react-server-dom-turbopack (npm) | 19.2.2 to before 19.2.3 | 19.2.3 | Patch available | GHSA-7gmr-mq3h-m5h9 |
| — | react-server-dom-webpack (npm) | 19.0.2 to before 19.0.3 | 19.0.3 | Patch available | GHSA-7gmr-mq3h-m5h9 |
| — | react-server-dom-webpack (npm) | 19.1.3 to before 19.1.4 | 19.1.4 | Patch available | GHSA-7gmr-mq3h-m5h9 |
| — | react-server-dom-webpack (npm) | 19.2.2 to before 19.2.3 | 19.2.3 | Patch available | GHSA-7gmr-mq3h-m5h9 |
- react-server-dom-parcel VendorMeta Affected 19.0.2 – 19.0.2; 19.1.3 – 19.1.3; 19.2.2 – 19.2.2 Fixed in — No fix listed CNA
- react-server-dom-turbopack VendorMeta Affected 19.0.2 – 19.0.2; 19.1.3 – 19.1.3; 19.2.2 – 19.2.2 Fixed in — No fix listed CNA
- react-server-dom-webpack VendorMeta Affected 19.0.2 – 19.0.2; 19.1.3 – 19.1.3; 19.2.2 – 19.2.2 Fixed in — No fix listed CNA
- react-server-dom-parcel (npm) Vendor— Affected 19.0.2 to before 19.0.3 Fixed in 19.0.3 Patch available GHSA-7gmr-mq3h-m5h9
- react-server-dom-parcel (npm) Vendor— Affected 19.1.3 to before 19.1.4 Fixed in 19.1.4 Patch available GHSA-7gmr-mq3h-m5h9
- react-server-dom-parcel (npm) Vendor— Affected 19.2.2 to before 19.2.3 Fixed in 19.2.3 Patch available GHSA-7gmr-mq3h-m5h9
- react-server-dom-turbopack (npm) Vendor— Affected 19.0.2 to before 19.0.3 Fixed in 19.0.3 Patch available GHSA-7gmr-mq3h-m5h9
- react-server-dom-turbopack (npm) Vendor— Affected 19.1.3 to before 19.1.4 Fixed in 19.1.4 Patch available GHSA-7gmr-mq3h-m5h9
- react-server-dom-turbopack (npm) Vendor— Affected 19.2.2 to before 19.2.3 Fixed in 19.2.3 Patch available GHSA-7gmr-mq3h-m5h9
- react-server-dom-webpack (npm) Vendor— Affected 19.0.2 to before 19.0.3 Fixed in 19.0.3 Patch available GHSA-7gmr-mq3h-m5h9
- react-server-dom-webpack (npm) Vendor— Affected 19.1.3 to before 19.1.4 Fixed in 19.1.4 Patch available GHSA-7gmr-mq3h-m5h9
- react-server-dom-webpack (npm) Vendor— Affected 19.2.2 to before 19.2.3 Fixed in 19.2.3 Patch available GHSA-7gmr-mq3h-m5h9
CPE configurations NVD · 85
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:facebook:react:19.0.2:*:*:*:*:*:*:* | 19.0.2 | Vulnerable | Meta |
| cpe:2.3:a:facebook:react:19.1.3:*:*:*:*:*:*:* | 19.1.3 | Vulnerable | Meta |
| cpe:2.3:a:facebook:react:19.2.2:*:*:*:*:*:*:* | 19.2.2 | Vulnerable | Meta |
| cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* | 13.3.0 to before 14.2.35; 15.0.0 to before 15.0.7; 15.1.0 to before 15.1.11; 15.2.0 to before 15.2.8; 15.3.0 to before 15.3.8; 15.4.0 to before 15.4.10; 15.5.0 to before 15.5.9; 16.0.0 to before 16.0.10 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:* | 15.6.0 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:* | 15.6.0 canary0 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:* | 15.6.0 canary1 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:* | 15.6.0 canary10 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:* | 15.6.0 canary11 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:* | 15.6.0 canary12 | Vulnerable | vercel |
- cpe:2.3:a:facebook:react:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Meta
- cpe:2.3:a:facebook:react:19.1.3:*:*:*:*:*:*:* Versions 19.1.3 Vulnerable ·Meta
- cpe:2.3:a:facebook:react:19.2.2:*:*:*:*:*:*:* Versions 19.2.2 Vulnerable ·Meta
- cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions 13.3.0 to before 14.2.35; 15.0.0 to before 15.0.7; 15.1.0 to before 15.1.11; 15.2.0 to before 15.2.8; 15.3.0 to before 15.3.8; 15.4.0 to before 15.4.10; 15.5.0 to before 15.5.9; 16.0.0 to before 16.0.10 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:* Versions 15.6.0 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:* Versions 15.6.0 canary0 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:* Versions 15.6.0 canary1 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:* Versions 15.6.0 canary10 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:* Versions 15.6.0 canary11 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:* Versions 15.6.0 canary12 Vulnerable ·vercel
Show 75 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:* | 15.6.0 canary13 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:* | 15.6.0 canary14 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:* | 15.6.0 canary15 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:* | 15.6.0 canary16 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:* | 15.6.0 canary17 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:* | 15.6.0 canary18 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:* | 15.6.0 canary19 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:* | 15.6.0 canary2 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:* | 15.6.0 canary20 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:* | 15.6.0 canary21 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:* | 15.6.0 canary22 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:* | 15.6.0 canary23 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:* | 15.6.0 canary24 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:* | 15.6.0 canary25 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:* | 15.6.0 canary26 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:* | 15.6.0 canary27 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:* | 15.6.0 canary28 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:* | 15.6.0 canary29 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:* | 15.6.0 canary3 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:* | 15.6.0 canary30 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:* | 15.6.0 canary31 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:* | 15.6.0 canary32 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:* | 15.6.0 canary33 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:* | 15.6.0 canary34 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:* | 15.6.0 canary35 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:* | 15.6.0 canary36 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:* | 15.6.0 canary37 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:* | 15.6.0 canary38 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:* | 15.6.0 canary39 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:* | 15.6.0 canary4 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:* | 15.6.0 canary40 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:* | 15.6.0 canary41 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:* | 15.6.0 canary42 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:* | 15.6.0 canary43 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:* | 15.6.0 canary44 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:* | 15.6.0 canary45 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:* | 15.6.0 canary46 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:* | 15.6.0 canary47 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:* | 15.6.0 canary48 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:* | 15.6.0 canary49 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:* | 15.6.0 canary5 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:* | 15.6.0 canary50 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:* | 15.6.0 canary51 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:* | 15.6.0 canary52 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:* | 15.6.0 canary53 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:* | 15.6.0 canary54 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:* | 15.6.0 canary55 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:* | 15.6.0 canary56 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:* | 15.6.0 canary57 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:* | 15.6.0 canary58 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:* | 15.6.0 canary59 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:* | 15.6.0 canary6 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:* | 15.6.0 canary7 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:* | 15.6.0 canary8 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:* | 15.6.0 canary9 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:-:*:*:*:node.js:*:* | 16.1.0 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary0:*:*:*:node.js:*:* | 16.1.0 canary0 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary1:*:*:*:node.js:*:* | 16.1.0 canary1 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary10:*:*:*:node.js:*:* | 16.1.0 canary10 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary11:*:*:*:node.js:*:* | 16.1.0 canary11 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary12:*:*:*:node.js:*:* | 16.1.0 canary12 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary13:*:*:*:node.js:*:* | 16.1.0 canary13 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary14:*:*:*:node.js:*:* | 16.1.0 canary14 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary15:*:*:*:node.js:*:* | 16.1.0 canary15 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary16:*:*:*:node.js:*:* | 16.1.0 canary16 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary17:*:*:*:node.js:*:* | 16.1.0 canary17 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary18:*:*:*:node.js:*:* | 16.1.0 canary18 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary2:*:*:*:node.js:*:* | 16.1.0 canary2 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary3:*:*:*:node.js:*:* | 16.1.0 canary3 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary4:*:*:*:node.js:*:* | 16.1.0 canary4 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary5:*:*:*:node.js:*:* | 16.1.0 canary5 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary6:*:*:*:node.js:*:* | 16.1.0 canary6 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary7:*:*:*:node.js:*:* | 16.1.0 canary7 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary8:*:*:*:node.js:*:* | 16.1.0 canary8 | Vulnerable | vercel |
| cpe:2.3:a:vercel:next.js:16.1.0:canary9:*:*:*:node.js:*:* | 16.1.0 canary9 | Vulnerable | vercel |
- cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:* Versions 15.6.0 canary13 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:* Versions 15.6.0 canary14 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:* Versions 15.6.0 canary15 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:* Versions 15.6.0 canary16 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:* Versions 15.6.0 canary17 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:* Versions 15.6.0 canary18 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:* Versions 15.6.0 canary19 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:* Versions 15.6.0 canary2 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:* Versions 15.6.0 canary20 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:* Versions 15.6.0 canary21 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:* Versions 15.6.0 canary22 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:* Versions 15.6.0 canary23 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:* Versions 15.6.0 canary24 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:* Versions 15.6.0 canary25 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:* Versions 15.6.0 canary26 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:* Versions 15.6.0 canary27 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:* Versions 15.6.0 canary28 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:* Versions 15.6.0 canary29 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:* Versions 15.6.0 canary3 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:* Versions 15.6.0 canary30 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:* Versions 15.6.0 canary31 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:* Versions 15.6.0 canary32 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:* Versions 15.6.0 canary33 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:* Versions 15.6.0 canary34 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:* Versions 15.6.0 canary35 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:* Versions 15.6.0 canary36 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:* Versions 15.6.0 canary37 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:* Versions 15.6.0 canary38 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:* Versions 15.6.0 canary39 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:* Versions 15.6.0 canary4 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:* Versions 15.6.0 canary40 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:* Versions 15.6.0 canary41 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:* Versions 15.6.0 canary42 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:* Versions 15.6.0 canary43 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:* Versions 15.6.0 canary44 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:* Versions 15.6.0 canary45 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:* Versions 15.6.0 canary46 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:* Versions 15.6.0 canary47 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:* Versions 15.6.0 canary48 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:* Versions 15.6.0 canary49 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:* Versions 15.6.0 canary5 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:* Versions 15.6.0 canary50 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:* Versions 15.6.0 canary51 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:* Versions 15.6.0 canary52 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:* Versions 15.6.0 canary53 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:* Versions 15.6.0 canary54 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:* Versions 15.6.0 canary55 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:* Versions 15.6.0 canary56 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:* Versions 15.6.0 canary57 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:* Versions 15.6.0 canary58 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:* Versions 15.6.0 canary59 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:* Versions 15.6.0 canary6 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:* Versions 15.6.0 canary7 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:* Versions 15.6.0 canary8 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:* Versions 15.6.0 canary9 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:-:*:*:*:node.js:*:* Versions 16.1.0 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary0:*:*:*:node.js:*:* Versions 16.1.0 canary0 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary1:*:*:*:node.js:*:* Versions 16.1.0 canary1 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary10:*:*:*:node.js:*:* Versions 16.1.0 canary10 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary11:*:*:*:node.js:*:* Versions 16.1.0 canary11 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary12:*:*:*:node.js:*:* Versions 16.1.0 canary12 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary13:*:*:*:node.js:*:* Versions 16.1.0 canary13 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary14:*:*:*:node.js:*:* Versions 16.1.0 canary14 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary15:*:*:*:node.js:*:* Versions 16.1.0 canary15 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary16:*:*:*:node.js:*:* Versions 16.1.0 canary16 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary17:*:*:*:node.js:*:* Versions 16.1.0 canary17 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary18:*:*:*:node.js:*:* Versions 16.1.0 canary18 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary2:*:*:*:node.js:*:* Versions 16.1.0 canary2 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary3:*:*:*:node.js:*:* Versions 16.1.0 canary3 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary4:*:*:*:node.js:*:* Versions 16.1.0 canary4 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary5:*:*:*:node.js:*:* Versions 16.1.0 canary5 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary6:*:*:*:node.js:*:* Versions 16.1.0 canary6 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary7:*:*:*:node.js:*:* Versions 16.1.0 canary7 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary8:*:*:*:node.js:*:* Versions 16.1.0 canary8 Vulnerable ·vercel
- cpe:2.3:a:vercel:next.js:16.1.0:canary9:*:*:*:node.js:*:* Versions 16.1.0 canary9 Vulnerable ·vercel
Remediation
- Fix · GHSA-7gmr-mq3h-m5h9 react-server-dom-parcel (npm) Fixed in 19.0.3 Advisory →
- Fix · GHSA-7gmr-mq3h-m5h9 react-server-dom-parcel (npm) Fixed in 19.1.4 Advisory →
- Fix · GHSA-7gmr-mq3h-m5h9 react-server-dom-parcel (npm) Fixed in 19.2.3 Advisory →
- Fix · GHSA-7gmr-mq3h-m5h9 react-server-dom-turbopack (npm) Fixed in 19.0.3 Advisory →
- Fix · GHSA-7gmr-mq3h-m5h9 react-server-dom-turbopack (npm) Fixed in 19.1.4 Advisory →
- Fix · GHSA-7gmr-mq3h-m5h9 react-server-dom-turbopack (npm) Fixed in 19.2.3 Advisory →
- Fix · GHSA-7gmr-mq3h-m5h9 react-server-dom-webpack (npm) Fixed in 19.0.3 Advisory →
- Fix · GHSA-7gmr-mq3h-m5h9 react-server-dom-webpack (npm) Fixed in 19.1.4 Advisory →
- Fix · GHSA-7gmr-mq3h-m5h9 react-server-dom-webpack (npm) Fixed in 19.2.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 8 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Trusted Artifact Signer
- streams for Apache Kafka 2
- streams for Apache Kafka 3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-67779
- 2026-10-03 Alias added: GHSA-7gmr-mq3h-m5h9
References
Advisory 3
More Meta React vulnerabilities
- TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
- TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
- TI-2025-34862 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1MEDIUM 5.3
- TI-2026-19225 Uncontrolled resource consumption in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
- TI-2018-04665 Cross-site scripting in Meta react-dom CVSS 3.1MEDIUM 6.1
Sources
- CVE-2025-67779 · CVE Program
- CVE-2025-67779 · NVD
- FIRST EPSS
- GHSA-7gmr-mq3h-m5h9 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-67779 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences