Every CVESearch/Get API key

GHSA-5j59-xgg2-r9c4

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

7.5 HighFix available

GHSA-5j59-xgg2-r9c4 is a high vulnerability (CVSS 7.5) in next, published December 12, 2025. No source lists public exploit code. Fixed in next 14.2.35.

What does this mean?
Severity
7.5 HighCVSS 3.1, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
14.2.35next +11 more

Description

It was discovered that the fix for CVE-2025-55184 in React Server Components was incomplete and did not fully mitigate denial-of-service conditions across all payload types. As a result, certain crafted inputs could still trigger excessive resource consumption.

This vulnerability affects React versions 19.0.2, 19.1.3, and 19.2.2, as well as frameworks that bundle or depend on these versions, including Next.js 13.x, 14.x, 15.x, and 16.x when using the App Router. The issue is tracked upstream as CVE-2025-67779.

A malicious actor can send a specially crafted HTTP request to a Server Function endpoint that, when deserialized, causes the React Server Components runtime to enter an infinite loop. This can lead to sustained CPU consumption and cause the affected server process to become unresponsive, resulting in a denial-of-service condition in unpatched environments.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Affected packages

Affected packages
PackageAffectedFixed
next
npm
13.3.1-canary.0 up to 14.2.35
14.2.35
next
npm
15.0.6 up to 15.0.7
15.0.7
next
npm
15.1.10 up to 15.1.11
15.1.11
next
npm
15.2.7 up to 15.2.8
15.2.8
next
npm
15.3.7 up to 15.3.8
15.3.8
next
npm
15.4.9 up to 15.4.10
15.4.10
next
npm
15.5.8 up to 15.5.9
15.5.9
next
npm
15.6.0-canary.59 up to 15.6.0-canary.60
15.6.0-canary.60
next
npm
16.0.9 up to 16.0.10
16.0.10
next
npm
16.1.0-canary.17 up to 16.1.0-canary.19
16.1.0-canary.19
next
Root:npm
before 14.2.5-aikido.5
14.2.5-aikido.514.2.5-aikido.814.2.33-aikido.214.2.32-aikido.414.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.2.3-aikido.114.2.15-aikido.414.0.4-aikido.913.4.19-aikido.214.1.3-aikido.214.2.24-aikido.214.2.25-aikido.214.1.0-aikido.414.2.18-aikido.214.2.15-aikido.313.4.19-aikido.314.0.4-aikido.514.0.4-aikido.714.1.0-aikido.714.1.0-aikido.814.2.13-aikido.114.2.3-aikido.514.2.0-aikido.214.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.29-aikido.514.2.31-aikido.214.2.18-aikido.114.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.10-aikido.214.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.1.4-aikido.514.2.25-aikido.114.2.0-aikido.614.0.4-aikido.414.2.31-aikido.514.2.0-aikido.514.2.2-aikido.914.2.30-aikido.814.0.3-aikido.614.2.32-aikido.514.2.33-aikido.314.0.0-aikido.514.2.5-aikido.314.2.3-aikido.314.2.2-aikido.414.2.2-aikido.514.2.2-aikido.613.5.4-aikido.514.2.30-aikido.214.1.3-aikido.614.2.5-aikido.414.2.30-aikido.314.0.3-aikido.414.2.13-aikido.214.2.5-aikido.614.2.21-aikido.414.0.0-aikido.314.1.4-aikido.714.2.21-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.213.5.6-aikido.214.2.30-aikido.414.2.33-aikido.414.2.26-aikido.314.0.3-aikido.514.2.30-aikido.914.1.4-aikido.814.2.32-aikido.613.5.4-aikido.614.1.3-aikido.714.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.5-aikido.714.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.213.5.6-aikido.313.5.6-aikido.414.2.28-aikido.514.2.32-aikido.214.1.4-aikido.914.2.32-aikido.713.5.6-aikido.514.2.15-aikido.614.2.26-aikido.114.1.3-aikido.814.2.32-aikido.814.2.29-aikido.414.2.28-aikido.114.2.33-aikido.513.5.6-aikido.614.2.26-aikido.514.2.28-aikido.214.2.26-aikido.214.0.4-aikido.814.2.28-aikido.314.1.0-aikido.214.2.31-aikido.314.1.4-aikido.614.2.18-aikido.314.1.0-aikido.514.2.16-aikido.314.0.0-aikido.414.1.0-aikido.314.2.18-aikido.413.5.4-aikido.314.2.0-aikido.313.4.19-aikido.514.0.0-aikido.214.2.31-aikido.414.2.29-aikido.213.5.4-aikido.414.1.3-aikido.314.2.21-aikido.314.2.32-aikido.314.2.29-aikido.313.5.11-aikido.914.1.3-aikido.414.2.0-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.614.2.18-aikido.513.5.6-aikido.714.2.35-aikido.914.2.35-aikido.514.2.35-aikido.314.2.35-aikido.614.2.35-aikido.214.2.35-aikido.714.2.35-aikido.814.2.35-aikido.414.2.35-aikido.114.2.35-aikido.1014.2.35-aikido.11
@rootio/next
Root:npm
before 14.2.5-root.io.5
14.2.5-root.io.514.2.5-root.io.814.2.33-root.io.214.2.32-root.io.414.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.2.3-root.io.114.2.15-root.io.414.0.4-root.io.913.4.19-root.io.214.1.3-root.io.214.2.25-root.io.214.2.24-root.io.214.1.0-root.io.414.2.18-root.io.214.2.15-root.io.314.0.4-root.io.513.4.19-root.io.314.0.4-root.io.714.1.0-root.io.714.1.0-root.io.814.2.13-root.io.114.2.3-root.io.514.2.0-root.io.214.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.29-root.io.514.2.31-root.io.214.2.18-root.io.114.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.10-root.io.214.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.1.4-root.io.514.2.25-root.io.114.2.0-root.io.614.0.4-root.io.414.2.31-root.io.514.2.0-root.io.514.2.2-root.io.914.2.30-root.io.814.0.3-root.io.614.2.32-root.io.514.2.33-root.io.314.0.0-root.io.514.2.5-root.io.314.2.3-root.io.314.2.2-root.io.413.5.4-root.io.514.2.2-root.io.514.2.2-root.io.614.2.30-root.io.214.1.3-root.io.614.2.5-root.io.414.2.30-root.io.314.0.3-root.io.414.2.13-root.io.214.2.5-root.io.614.2.21-root.io.414.0.0-root.io.314.1.4-root.io.714.2.21-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.213.5.6-root.io.214.2.30-root.io.414.2.33-root.io.414.2.26-root.io.314.0.3-root.io.514.2.30-root.io.914.1.4-root.io.814.2.32-root.io.613.5.4-root.io.614.1.3-root.io.714.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.5-root.io.714.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.213.5.6-root.io.313.5.6-root.io.414.2.28-root.io.514.2.32-root.io.214.1.4-root.io.914.2.32-root.io.713.5.6-root.io.514.2.15-root.io.614.2.26-root.io.114.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.28-root.io.114.2.33-root.io.513.5.6-root.io.614.2.26-root.io.514.2.28-root.io.214.2.26-root.io.214.0.4-root.io.814.2.28-root.io.314.1.0-root.io.214.2.31-root.io.314.1.4-root.io.614.2.18-root.io.314.1.0-root.io.514.2.16-root.io.314.0.0-root.io.414.1.0-root.io.314.2.18-root.io.413.5.4-root.io.314.2.0-root.io.313.4.19-root.io.514.0.0-root.io.214.2.31-root.io.414.2.29-root.io.213.5.4-root.io.414.1.3-root.io.314.2.21-root.io.314.2.32-root.io.314.2.29-root.io.313.5.11-root.io.914.1.3-root.io.414.2.0-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.613.5.6-root.io.714.2.18-root.io.514.2.35-root.io.914.2.35-root.io.514.2.35-root.io.314.2.35-root.io.614.2.35-root.io.214.2.35-root.io.714.2.35-root.io.814.2.35-root.io.414.2.35-root.io.114.2.35-root.io.1014.2.35-root.io.11

What each source reports

GitHub Advisories Score used7.5

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

It was discovered that the fix for CVE-2025-55184 in React Server Components was incomplete and did not fully mitigate denial-of-service conditions across all payload types. As a result, certain crafted inputs could still trigger excessive resource consumption.

This vulnerability affects React versions 19.0.2, 19.1.3, and 19.2.2, as well as frameworks that bundle or depend on these versions, including Next.js 13.x, 14.x, 15.x, and 16.x when using the App Router. The issue is tracked upstream as CVE-2025-67779.

A malicious actor can send a specially crafted HTTP request to a Server Function endpoint that, when deserialized, causes the React Server Components runtime to enter an infinite loop. This can lead to sustained CPU consumption and cause the affected server process to become unresponsive, resulting in a denial-of-service condition in unpatched environments.

Record
GHSA-5j59-xgg2-r9c4
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-502, CWE-1395
Updated
2026-11-02
OSV7.5

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

It was discovered that the fix for CVE-2025-55184 in React Server Components was incomplete and did not fully mitigate denial-of-service conditions across all payload types. As a result, certain crafted inputs could still trigger excessive resource consumption.

This vulnerability affects React versions 19.0.2, 19.1.3, and 19.2.2, as well as frameworks that bundle or depend on these versions, including Next.js 13.x, 14.x, 15.x, and 16.x when using the App Router. The issue is tracked upstream as CVE-2025-67779.

A malicious actor can send a specially crafted HTTP request to a Server Function endpoint that, when deserialized, causes the React Server Components runtime to enter an infinite loop. This can lead to sustained CPU consumption and cause the affected server process to become unresponsive, resulting in a denial-of-service condition in unpatched environments.

Record
GHSA-5j59-xgg2-r9c4
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1395, CWE-400, CWE-502
Updated
2026-11-02
OSVROOT-APP-NPM-GHSA-5j59-xgg2-r9c4No score

GHSA-5j59-xgg2-r9c4 in next - Patched by Root

Root has patched GHSA-5j59-xgg2-r9c4 in the next package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-GHSA-5j59-xgg2-r9c4
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open