CVE-2025-67779: the incomplete React Server Components DoS fix, and what to install now

What CVE-2025-67779 is, in plain words

React Server Components (RSC) run part of a React app on the server. When the browser calls a Server Function (a Server Action, in Next.js), it sends the arguments in a serialized format and the server decodes them back into values. On December 11, 2025, React fixed a bug in that decoding step, CVE-2025-55184: a crafted request could send the server into an infinite loop. That fix did not cover every payload type. CVE-2025-67779 is the case it missed. On the releases that shipped the first fix, a crafted HTTP request to a Server Function endpoint still puts the process in an infinite loop that hangs it, and the server may stop serving other requests.

The React team found the missing case internally and shipped a complete fix the same day. The npm registry shows how short the window was: React 19.2.2, the first patch, was published at 20:02 UTC, and 19.2.3, the complete one, at 22:55 UTC. Next.js 14.2.34 went out at 21:01 UTC and 14.2.35 at 23:36 UTC. Anyone who upgraded during those hours, or pinned the version numbers from the first announcements, may still run a release with the gap.

What a stranger can and cannot do

• Hang your server process with one request and no account. The CVSS vector rates the attack as reachable over the network, with low complexity and no privileges needed.
• Keep it down. CISA rates the attack as automatable, so a restart only lasts until the next request arrives.
• Nothing more. The impact on confidentiality and integrity is rated none: no data, secret or source code leaks through this CVE. Code execution in the same React code was React2Shell, CVE-2025-55182.

Affected and fixed versions

Two databases draw the range a little differently. GitHub's advisories list mostly the releases that shipped the first patch (on Next.js 15 and 16, only those) and file older releases under CVE-2025-55184. NVD's record lists every Next.js release from 13.3.0 up to the complete fix. The fixed versions are the same in both, and an older release is affected by CVE-2025-55184 anyway. So the rule is simple: below the complete fix for your line, you are affected.

There is no fixed Next.js 13 release: the Next.js advisory sends everyone on 13.3 or later to 14.2.35, which is still the newest 14.x release on npm.

Severity and exploitation status

Meta, the CVE numbering authority (CNA) for React, rates CVE-2025-67779 7.5, high, with the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H: network access, low complexity, no privileges, no user interaction, and an impact on availability only. NVD displays Meta's score and has not published one of its own. It classifies the weakness as CWE-502, deserialization of untrusted data, and CISA adds CWE-400, uncontrolled resource consumption.

Who is affected

Your host does not change whether you are affected. The installed version does. Vercel updated its bulletin at 4:31 PM PST on December 11, 2025 to say the first fix was incomplete and that everyone must upgrade to the latest patched versions. On a server you run yourself, with next start on a VPS or in a container, a hung process is the whole site unless several instances share the traffic.

How to check your version

Check the version your lockfile installs, not the range in package.json. A project that pinned "next": "15.0.6" on December 11 stays on it until someone changes the line. Run these at the root of your project:

# npm
npm ls next react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel

# pnpm (add -r in a monorepo)
pnpm why next

# yarn
yarn why next

# the version Next.js reports
npx next --version

# package-lock.json
grep -A1 '"node_modules/next"' package-lock.json

# pnpm-lock.yaml
grep -oE '(^| |/)next@[0-9][0-9A-Za-z.-]*' pnpm-lock.yaml | sort -u

# yarn.lock (Yarn 1 and Yarn Berry)
grep -A1 -E '^"?next@' yarn.lock

Check what production runs

A fixed lockfile in the repository says nothing about a build that was never redeployed. Near the top of its output, next build prints the Next.js version it runs, so read it in the log of your last production build. To see whether production answers React Server Components requests at all, send your own app the header the App Router uses for them:

curl -s -o /dev/null -D - -H "RSC: 1" https://your-app.example/ | grep -i content-type

How to fix CVE-2025-67779

There is no workaround: the Next.js advisory says upgrading to a patched version is required. The floors in the table above close this CVE, but they are not where you should stop. On January 26, 2026, the React team disclosed more denial of service cases as CVE-2026-23864, and GitHub's advisory for it lists 19.0.3, 19.1.4 and 19.2.3 as affected. The matching Next.js advisory lists every release from 13.0.0 below 15.0.8, and each later line below its January patch, 15.5.9 and 16.0.10 included. Three more React denial of service CVEs followed in April, May and July 2026. So install the current patch of a supported line:

# Next.js 16 (Active LTS), current patch on November 6, 2026
npm install [email protected]

# Next.js 15 (Maintenance LTS), if 16 is not possible yet
npm install [email protected]

# the same with pnpm or yarn
pnpm add [email protected]
yarn add [email protected]

# other RSC frameworks: update React and the server package
# your bundler uses (webpack, parcel or turbopack)
npm install react@latest react-dom@latest react-server-dom-webpack@latest

Outside Next.js, the React server packages need at least 19.0.8, 19.1.9 or 19.2.8, the versions that fix CVE-2026-44907 from July 2026. On November 6, 2026 the newest release of each line on npm was 19.0.9, 19.1.10, 19.2.9 and 19.3.1. If you are on Next.js 13 or 14 and cannot move yet, 14.2.35 closes CVE-2025-67779, but no newer 14.x release exists, and the 2026 Next.js advisories, such as CVE-2026-64641, another Server Actions denial of service, list every 14.x release with no 14.x fix. Treat it as a stopgap while you plan the move.

The December advisory also points to npx fix-react2shell-next, an interactive tool that checks your versions and bumps them to the releases that advisory recommended. It was built for the December releases, so check where it leaves you against the versions above.

What to do after upgrading

1. 1

   Confirm production runs the fix

   Redeploy, then read the Next.js version in the build log, or run the version check on the lockfile your host built from. A build cache or an old container image can keep the vulnerable release online.

2. 2

   Retire old deployments

   Preview and staging deployments built before the fix still run the old code, and they answer requests like production does. Delete the ones you do not need and put the rest behind access protection.

3. 3

   Rotate keys only if another CVE applies

   This bug reads nothing, so it is no reason on its own to rotate secrets. If your version was also below the React2Shell fix, follow the React2Shell page: that one ran code on the server.

4. 4

   Make a hung process cost less

   The symptom is a Node.js process pinned on CPU that stops answering while timeouts climb. Two or more instances, behind a health check that restarts a process that stops responding, limit the damage of this whole class of bug. It does not replace the upgrade.

Related CVEs in the same family

Every CVE below sits in the same React Server Components decoding code, and each one needs a newer release than the one before it. Next.js ships each fix in its own release, so on Next.js compare your next version with its advisory, not these React versions.

Timeline

What Keybrum checks on a live app

Keybrum never sends a denial of service payload: hanging a server to prove a point is downtime for its owner. So for this CVE, a Keybrum attack proves the surface, not the bug. With one ordinary request carrying the RSC header, it confirms that your production domain answers the React Server Components protocol, counts the Server Action ids your JavaScript ships, and lists the React2Shell family, its denial of service CVEs included, as a live surface that was not exploited. Whether that surface runs a patched release is what the version check above tells you.

The Next.js security guide covers the rest of the framework, and vibe coding security risks covers what AI-built apps leak most often.