Loading story…
Multiple vulnerabilities have been identified in React Server Components (RSC), specifically CVE-2025-55183, CVE-2025-55184, and CVE-2025-67779, affecting several versions of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. These vulnerabilities, discovered following the React2Shell incident, include a high-severity denial-of-service (DoS) flaw (CVE-2025-55184) caused by unsafe deserialization of structured input in the RSC Flight protocol, which can be exploited by sending specially crafted requests that trigger infinite loops or event-loop lockups on the server. The vulnerabilities also raise concerns about potential source code exposure and highlight the risk of residual flaws being discovered after major disclosures.
The React Foundation has issued advisories and patches for affected versions, and the Canadian Centre for Cyber Security has urged administrators to update impacted libraries and frameworks, including popular tools such as Next.js, Vite RSC plugin, Parcel RSC plugin, React Router RSC preview, RedwoodSDK, and Waku. No public exploits are currently available, but the vulnerabilities have a higher-than-average likelihood of exploitation, emphasizing the importance of prompt remediation and ongoing vigilance for follow-on issues after initial vulnerability disclosures.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2025-12-15, the Cyber Centre published advisory AV25-834 warning that frameworks and libraries bundling React server implementations, such as Next.js, Vite RSC plugin, Parcel RSC plugin, React Router RSC preview, RedwoodSDK, and Waku, were also likely impacted. It urged organizations to review exposure and apply patches immediately.
React provided fixes for the newly disclosed vulnerabilities in versions 19.0.3, 19.1.4, and 19.2.3. Applications using React 19.0.0 through 19.2.2 were identified as affected, including deployments that had already patched for React2Shell.
On 2025-12-11, the React Foundation published a security advisory covering CVE-2025-55183, CVE-2025-55184, and CVE-2025-67779 in react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. The advisory identified denial-of-service and source code exposure risks in affected React server-side libraries.
After React2Shell was disclosed, deeper inspection of React Server Components uncovered three additional vulnerabilities: CVE-2025-55183, CVE-2025-55184, and CVE-2025-67779. The issues introduced risks including denial of service and server-side source code exposure.
A prior major disclosure, React2Shell (CVE-2025-55182), was publicly disclosed before the follow-on issues. Subsequent investigation into the React codebase occurred after this disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have identified three new vulnerabilities in React Server Components (RSC) following the recent patch for the critical React2Shell exploit. These flaws include two high-severity Denial-of-Service (DoS) vulnerabilities (CVE-2025-55184 and CVE-2025-67779) and a medium-severity Source Code Exposure vulnerability (CVE-2025-55183). The DoS vulnerabilities allow attackers to send malicious HTTP requests to Server Function endpoints, triggering infinite loops that hang the server and exhaust CPU resources, effectively taking applications offline. The source code exposure flaw enables attackers to craft HTTP requests that can leak the source code of server functions, potentially exposing hardcoded secrets or sensitive logic, though runtime secrets remain protected. The affected packages are `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack`, impacting React versions 19.0.0 through 19.2.2 and frameworks such as Next.js, Waku, and React Router. Initial patches released for these vulnerabilities were incomplete, necessitating immediate upgrades to versions 19.0.3, 19.1.4, and 19.2.3 to ensure full protection. The vulnerabilities were discovered by security researchers during attempts to bypass previous mitigations, highlighting the importance of rapid patch adoption and ongoing scrutiny of critical code paths after major disclosures. Users are strongly advised to update affected packages and monitor official channels for further security updates.
Jun 29, 2026
A denial-of-service (DoS) vulnerability, tracked as CVE-2025-55184, has been identified in React Server Components (RSC) affecting versions 19.0.0 through 19.2.1 and related packages such as `react-server-dom-parcel`, `react-server-dom-turbopack`, and `react-server-dom-webpack`. The flaw arises from unsafe deserialization of payloads in the React Flight protocol, allowing specially crafted HTTP requests to trigger infinite loops or hung server states, rendering affected applications unresponsive. This issue is particularly relevant for applications using Next.js App Router or other RSC-enabled frameworks. The vulnerability is distinct from the earlier React2Shell (CVE-2025-55182) RCE but shares the same deserialization layer, and an incomplete initial patch led to a follow-up vulnerability, CVE-2025-67779, requiring further updates. Security advisories confirm that F5 products are not directly affected by CVE-2025-55184, but F5's WAF solutions can be used to mitigate the impact for organizations using vulnerable backend applications. Remediation steps include upgrading to the latest patched versions of React and Next.js, ensuring all related vulnerabilities are addressed, and rescanning for follow-up CVEs. Organizations are advised not to rely solely on early patches and to validate that all vulnerable RSC packages and serialization paths are fully remediated to prevent exploitation of this DoS flaw.
Jun 29, 2026
A critical remote code execution vulnerability in React Server Components-related packages is affecting widely used parts of the React ecosystem, including deployments tied to **Next.js**, **React Router**, **Expo**, **Redwood SDK**, **Waku**, and `@vitejs/plugin-rsc`. The flaw allows an unauthenticated attacker to execute arbitrary code on a vulnerable system through an HTTP request. Affected versions include `19.0`, `19.1.0`, `19.1.1`, and `19.2.0` of `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack`, while patched releases are `19.0.1`, `19.1.2`, and `19.2.1`. Authorities warned that exploitation is already active in Finland and that public exploit methods are available, increasing the likelihood of rapid opportunistic attacks against exposed applications. Officials said attackers may use the vulnerability not only for visible abuse such as cryptomining but also to establish persistent access, and urged organizations to patch immediately and assess internet-exposed systems for signs of compromise.
Jun 29, 2026