CVE
CVE-2025-67779
- First Reported
- Oct 29, 2026
- Latest Reported
- Oct 29, 2026
CVE Enrichment
- CVSS
- 7.5 HIGH
- EPSS
- 19.99%
- EPSS Percentile
- 97.43%
- CISA KEV
- Not listed
Description
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- [email protected]
- Published
- 12-Dec-2025 07:15
- Last Modified
- 08-Oct-2026 03:10
- EPSS Date
- 2026-10-29
- CWE
- CWE-502, CWE-400
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:N /
UI:N /
S:U /
C:N /
I:N /
A:H
Affected Products / Versions
- facebook / react
Version / affected range: 19.0.2
cpe:2.3:a:facebook:react:19.0.2:*:*:*:*:*:*:* - facebook / react
Version / affected range: 19.1.3
cpe:2.3:a:facebook:react:19.1.3:*:*:*:*:*:*:* - facebook / react
Version / affected range: 19.2.2
cpe:2.3:a:facebook:react:19.2.2:*:*:*:*:*:*:* - vercel / next.js
Version / affected range: * · from (inclusive) 13.3.0 · before (exclusive) 14.2.35
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.7
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.11
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: * · from (inclusive) 15.2.0 · before (exclusive) 15.2.8
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: * · from (inclusive) 15.3.0 · before (exclusive) 15.3.8
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: * · from (inclusive) 15.4.0 · before (exclusive) 15.4.10
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: * · from (inclusive) 15.5.0 · before (exclusive) 15.5.9
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: * · from (inclusive) 16.0.0 · before (exclusive) 16.0.10
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:-:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary0:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary1:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary10:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary11:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary12:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary13:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary14:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary15:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary16:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary17:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary18:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary2:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary3:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary4:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary5:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary6:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary7:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary8:*:*:*:node.js:*:* - vercel / next.js
Version / affected range: 16.1.0
cpe:2.3:a:vercel:next.js:16.1.0:canary9:*:*:*:node.js:*:*
References
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- Security Agency, added it to its list of vulnerabilities exploited in real attacks. A follow-up bug, CVE-2025-67779, got around the original patch, so teams had to upgrade a second time. How Log4Shell, React2Shell, PHP2Shell and Node2Shell Enable Remote Code Execution
CVE (5)
People (2)
MITRE ATT&CK (4)
Products (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.