18:I[95426,["231","static/chunks/231-e0a106687e0f7edf.js","6367","static/chunks/app/%5Blng%5D/ucsafe/%5BdocumentId%5D/page-e383ab9d1699df67.js"],"default"] 19:T6e8,### Vulnerability Details UCloud Security Center has recently detected that the React team has released a patch addressing the **React Server Components Denial of Service vulnerability (CVE-2025-55184)**. Attackers can craft malicious requests to trigger an infinite loop during server-side deserialization, causing the server process to block and become unable to handle subsequent HTTP requests, resulting in a **Denial of Service (DoS)**. Since Next.js depends on the vulnerable React server-side DOM components, it is also affected, giving rise to the Next.js Denial of Service vulnerability (CVE-2025-67779). A proof-of-concept (PoC) has been publicly disclosed online. **Multiple applications, including Dify, have been confirmed to be affected, posing a high risk.** ### Affected Scope **I. Affected Versions** - React Server < 19.0.3 - React Server < 19.1.4 - React Server < 19.2.3 **II. Affected Components** - Next.js 14.x < 14.2.35 - Next.js 15.0.x < 15.0.7 - Next.js 15.1.x < 15.1.11 - Next.js 15.2.x < 15.2.8 - Next.js 15.3.x < 15.3.8 - Next.js 15.4.x < 15.4.10 - Next.js 15.5.x < 15.5.9 - Next.js 15.x canary < 15.6.0-canary.60 - Next.js 16.0.x < 16.0.10 - Next.js 16.x canary < 16.1.0-canary.19 - Dify, and others ### Remediation **Official security patches have been released. Please update to the latest versions promptly:** React Server >= 19.0.3 React Server >= 19.1.4 React Server >= 19.2.3 ### References [https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) [https://nextjs.org/blog/security-update-2025-12-11](https://nextjs.org/blog/security-update-2025-12-11)

UCloud-202512-003:React Server Components Denial of Service Vulnerability Security Advisory