CVE-2025-67779

Katalog CVE

CVSS 7.5 · High EPSS 20,0%

Kerentanan Deserialization of Untrusted Data pada facebook react, vercel next.js. Skor CVSS 3.1 7.5 (High) menurut fb.com.

Deskripsi (NVD)

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

Rincian

Terbit di NVD

12 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber fb.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data
CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

20,0% peluang dieksploitasi; lebih tinggi dari 97,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 92 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components advisory vendor
• https://www.facebook.com/security/advisories/cve-2025-67779 advisory vendor