CVE-2025-67779

Name of the Vulnerable Software and Affected Versions React versions 19.0.2 through 19.2.2

Description An incomplete fix for a previous issue allows for a denial of service attack in React Server Components. Specifically, unsafe deserialization of payloads from HTTP requests to Server Function endpoints can cause an infinite loop, potentially hanging the server process and preventing it from serving future requests. This issue affects servers utilizing React Server Components. The issue can be triggered by certain payload shapes.

Recommendations React versions 19.0.2 through 19.1.3 should be updated to version 19.2.3. React version 19.2.2 should be updated to version 19.2.3.