CVE-2025-67779

Name of the Vulnerable Software and Affected Versions React versions 19.0.2 through 19.2.2

Description An incomplete fix for a previous issue allows for a denial of service attack in React Server Components. Unsafe deserialization of payloads from HTTP requests to Server Function endpoints can cause an infinite loop, potentially hanging the server process and preventing it from serving future requests. The issue affects Server Function endpoints and involves payloads that trigger the infinite loop.

Recommendations React version 19.2.3 contains a fix for this vulnerability. React versions 19.0.2 through 19.2.2 should be updated to version 19.2.3.