CVE-2025-67779

score

<0.1

cvss

7.5

epss

20.0%

published

2025-12-12

kev added

—

first seen

2026-10-21

React Server Components 19.0.2, 19.1.3, and 19.2.2 contain an insecure deserialization vulnerability caused by unsafe deserialization of payloads in Server Function endpoints, letting attackers cause denial of service via infinite loop, exploit requires crafted HTTP requests.