Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, reac

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• facebook react19.0.0 and later · before 19.0.4
• facebook react19.1.0 and later · before 19.1.5
• facebook react19.2.0 and later · before 19.2.4

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Meta). Independent of NVD's CPE analysis and usually ahead of it.

• Meta react-server-dom-parcel

  • 19.0.0 and later · before 19.0.4affected · semver
  • 19.1.0 and later · before 19.1.5affected · semver
  • 19.2.0 and later · before 19.2.4affected · semver

• Meta react-server-dom-turbopack

  • 19.0.0 and later · before 19.0.4affected · semver
  • 19.1.0 and later · before 19.1.5affected · semver
  • 19.2.0 and later · before 19.2.4affected · semver

• Meta react-server-dom-webpack

  • 19.0.0 and later · before 19.0.4affected · semver
  • 19.1.0 and later · before 19.1.5affected · semver
  • 19.2.0 and later · before 19.2.4affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2025-55182A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 incluKEV
  100Now
• CVE-2025-55184A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.
  50Plan
• CVE-2025-67779It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attac
  36Monitor
• CVE-2018-6341React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time.
  25Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.