React Server Components security update: DoS and Source Code Exposure
By Steven Van ·
Two new React Server Components flaws need patching even after the React2Shell fix, and Vercel's WAF alone won't cover it.
Security researchers examining the patches for the earlier React2Shell vulnerability found two more issues in React Server Components: a high-severity Denial of Service (CVE-2025-55184) and a medium-severity Source Code Exposure (CVE-2025-55183). Neither allows remote code execution.
- CVE-2025-55184: a crafted HTTP request to any App Router endpoint can, when deserialized, hang the server process and consume CPU.
- CVE-2025-55183: a crafted request to an App Router endpoint can return the compiled source code of Server Actions, exposing business logic (but not hardcoded secrets, unless they were already in the code).
Both affect React 19.0.0 through 19.2.1 and frameworks built on it, including Next.js 13.x through 16.x, as well as Vite, Parcel, React Router, RedwoodSDK and Waku. Vercel pushed new Web Application Firewall rules to protect all hosted projects automatically at no cost, but says this does not replace upgrading and that immediate upgrades are required. The same day, Vercel added that the initial React2Shell fix hadn't fully closed the DoS hole for all payload types (tracked as CVE-2025-67779), so everyone needs to move to the latest patched release rather than the first round of fixes. React is fixed in 19.0.2, 19.1.3 and 19.2.2; see the security bulletin for the patched Next.js versions.
