CVE-2025-55182-analysis

1. 취약점 개요 최근 React의 역직렬화 RCE 취약점이 이슈가 되고 있습니다. 공식 CVSS는 10.0점으로, 당시 Log4j와 동일한 수준입니다. 한때 많은 소문이 현대 프론트엔드의 Log4j라고 불리며 많은 회사 개발자들의 공포를 불러일으켰고, 모두가 일어나자마자 다양한 문헌을 찾아보고 패치를 적용하기 시작했습니다... 동시에 온라인에서는 많은 의문이 제기되었으며, 일부 테스트 결과 이 취약점이 알려진 것만큼 심각하지 않고 오히려 특정 조건이 필요하다는 것이 밝혀졌습니다. 그래서 저는 시간을 내어 이 취약점을 깊이...

-CVE-2025-55182

🔍 GitHub CVE Scanner - 使用ガイド GitHub リポジトリをスキャンして、React および Next.js プロジェクトの既知の脆弱性を検出するスクリプトです。 📋 検出される脆弱性 スキャナーは以下の CVE をチェックします: CVE-2025-55182 : React Server Components の脆弱性 影響を受けるバージョン: React 19.0.0, 19.1.0, 19.1.1, 19.2.0 修正済みバージョン: 19.0.1, 19.1.2, 19.2.1 チェック対象パッケージ: react, react-dom,...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-44907: Undefined Security Weakness

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

The vulnerabilities of the React frontend building libraries React-server-dom-parcel, React-server-dom-turbopack, and React-server-dom-webpack allow attackers to cause service failures.

The vulnerability of the React frontend library packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack involves uncontrolled resource consumption. Exploiting this vulnerability can allow an attacker to cause service failures by sending specially crafted HTTP...

CVE-2026-23870: Undefined Security Weakness

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel,...

VulnCheck KEV: CVE-2025-55184

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafe...

React Server Components have a Denial of Service Vulnerability

Impact A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack versions 19.0.0, 19.1.0 and 19.2.0. The vulnerability is triggered by sending specially crafted HTTP requests...

K000160686: React framework vulnerability CVE-2026-23869

Security Advisory Description A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4. T...

CVE-2026-23869

A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4. The vulnerability is triggered ...

CVE-2026-23869

A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4. The vulnerability is triggered ...

CVE-2026-23869

A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4. The vulnerability is triggered ...

CVE-2026-23869: Uncontrolled Resource Consumption

A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4. The vulnerability is triggered ...

Allocation of Resources Without Limits or Throttling

Overview react-server-dom-turbopack is a React Server Components bindings for DOM using Turbopack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...

CVE-2026-23864

Multiple denial of service vulnerabilities exist in React Server Components , specifically affecting the packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The flaws are triggered by sending specially crafted HTTP requests to Server Function endpoints. The...

CVE-2026-23864: Uncontrolled Resource Consumption

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints,...

GHSA-7GMR-MQ3H-M5H9 Denial of Service Vulnerability in React Server Components

Impact It was found that the fix to address CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. We recommend updating immediately. The vulnerability exists in versions 19.0.2, 19.1.3, and 19.2.2 of: - react-server-dom-webpac...

Node.js React Server Components Denial of Service (CVE-2025-67779)

Multiple Node.js React Server Components packages are affected by a denial of service vulnerability. The following Node.js packages and versions are affected: - react-server-dom-webpack 19.0.2, 19.1.3, 19.2.2 - react-server-dom-parcel 19.0.2, 19.1.3, 19.2.2 - react-server-dom-turbopack 19.0.2,...

CVE-2025-55184

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafe...

CVE-2025-55183

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically...