DNA View

High Severity Vulnerability

This vulnerability has been rated as High severity. Immediate action is recommended.

CVE-2025-55184

High

Low Medium High Critical

7.5

CVSS Score

Published: Dec 11, 2025

Last Modified: Dec 15, 2025

CWE: CWE-502

Vulnerability Description

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Known Affected Software

2 configuration(s) from 1 vendor(s)

next.js

Version:

15.6.0

CPE:

cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:*

next.js

Version:

16.1.0

CPE:

cpe:2.3:a:vercel:next.js:16.1.0:canary16:*:*:*:node.js:*:*

This vulnerability affects 2 software configuration(s). Ensure you patch all affected systems.

Available Security Patches

1 patch available from vendors

View All Patches

Oracle

CPUAPR2026

Oracle Critical Patch Update Advisory - April 2026

Severity

Critical

Released

Apr 21, 2026

Restart Required

Security Update

View Details Vendor Page

Browse All Security Patches

References & Resources

Severity Details

7.5

out of 10.0

High

Weakness Type (CWE)

CWE-502 Top 25 #15

Deserialization of Untrusted Data

Description: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Exploit Likelihood: Medium
Typical Severity: Medium
OWASP Top 10: A08:2021-Software/Data Integrity Failures
Abstraction Level: Base