CVE-2025-55184

Technical Details

The vulnerability stems from the insecure deserialization of data received by Server Function endpoints in React Server Components. Specifically, the affected versions of react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack do not adequately sanitize or validate incoming data before deserializing it. A specially crafted HTTP request payload can exploit this weakness by injecting malicious data that causes the deserialization process to enter an infinite loop. This loop consumes server resources, ultimately leading to a denial of service as the server becomes unresponsive. The pre-authentication nature of this vulnerability means that an attacker does not need valid credentials to trigger the DoS condition.

The root cause lies in the way React Server Components handle data passed to Server Functions. These functions are designed to execute on the server, and their inputs are typically serialized and transmitted from the client. The deserialization process, if not properly secured, can become a gateway for attackers to inject arbitrary code or data that disrupts the server's operation. In this case, the vulnerability allows an attacker to create a payload that causes the deserialization logic to enter an infinite loop, effectively locking up the server process.