Meta react-server-dom-webpack
En bref
- Source
- NVD
- EPSS
- EPSS 66.62 % · centile 99 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Meta
- Statut NVD
- Modified
Rechercher sur…
Description
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
Faiblesses (CWE)
- CWE-502 — Désérialisation de données non fiables
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | Meta |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · cve-assign@fb.com (Secondary) |
Avis
- GHSA-2m3v-v2m8-q956 — Denial of Service Vulnerability in React Server Components
Références européennes
- ENISA EUVD · EUVD-2025-202877
- GCVE · GCVE-0-2025-55184
Avis du CERT-FR
- CERTFR-2026-AVI-0249 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1137 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*≥ 19.0.0 < 19.0.2cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*≥ 19.1.0 < 19.1.3cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*≥ 19.2.0 < 19.2.2cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*≥ 13.3.0 < 14.2.35cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*≥ 15.0.0 < 15.0.7cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*≥ 15.1.0 < 15.1.11cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*≥ 15.2.0 < 15.2.8cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*≥ 15.3.0 < 15.3.8cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*≥ 15.4.0 < 15.4.10cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*≥ 15.5.0 < 15.5.9cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*≥ 16.0.0 < 16.0.10cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:*- +52 autres
Produits affectés
| Produit | Versions |
|---|---|
| Meta · react-server-dom-webpack | affected 19.0.0 ≤ 19.0.1 ; affected 19.1.0 ≤ 19.1.2 ; affected 19.2.0 ≤ 19.2.1 |
| Meta · react-server-dom-turbopack | affected 19.0.0 ≤ 19.0.1 ; affected 19.1.0 ≤ 19.1.2 ; affected 19.2.0 ≤ 19.2.1 |
| Meta · react-server-dom-parcel | affected 19.0.0 ≤ 19.0.1 ; affected 19.1.0 ≤ 19.1.2 ; affected 19.2.0 ≤ 19.2.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |