PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

React & Next.js DoS Vulnerability (CVE-2025-55184): What You Need to Fix After React2Shell

aikido.dev | vulnerability | High | CVE-2025-55184 | #appsec | #vulnerability-research | #denial-of-service | #deserialization | #react2shell | #nextjs | #react | #dos | #cve-2025-55184 | #rsc
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2025-55184 is a DoS flaw in React Server Components tied to the same Flight deserialization layer as React2Shell; crafted requests hang servers, and teams must also patch follow-up CVE-2025-67779.
CVE
CVE-2025-55184
CVSS
7.5
Published
Collected

Related coverage

Critical · vulnerability · xbow.com
React2Shell (CVE-2025-55182): A Wake-Up Call for Modern Web Security and How XBOW Helps You Respond
Covers React2Shell (CVE-2025-55182), an unauthenticated RCE in React Server Components' serialization that also affects Next.js and more, and how to quickly scope exposure.
vulnerability · jfrog.com
CVE-2025-55182 and CVE-2025-66478 (“React2Shell”): All you need to know – UPDATED
JFrog's living advisory on React2Shell (CVE-2025-55182 / CVE-2025-66478): a near-100%-success RCE in React Server Functions and Next.js, now with public exploits, plus follow-on DoS fixes.
vulnerability · wiz.io
React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182
Wiz details CVE-2025-55182 exploit mechanics—insecure deserialization in React Server Components—and maps in-the-wild attacks from cryptomining and credential harvesting to Sliver backdoors.
vulnerability · blog.trailofbits.com
Numbers turned weapons: DoS in Osmosis’ math library
Trail of Bits discloses a DoS in Osmosis' math library: an unbounded Taylor-series loop in PowApprox lets crafted transactions burn seconds of compute for little gas, enough to halt the chain.
Critical · vulnerability · hackerone.com
CVE-2025-55182: Unauthenticated React Exploit Affects Millions of Sites
A critical CVE-2025-55182 React RCE flaw affects millions of sites. Get impact details, affected versions, indicators of compromise, and urgent remediation steps.
Critical · vulnerability · hunt.io
React2Shell (CVE-2025-55182): Node.js RCE Against a Production Next.js App
A log-level reconstruction of CVE-2025-55182 (React2Shell) on a live Next.js app: RCE via the RSC Flight protocol, 12,440 logs, four C2 servers—though a stripped container blocked later stages.
Back