Security Research

CVE-2025-55184 React Server Components Infinite Loop DoS: A Single Payload Locks CPU

#Vulnerability Analysis#Code Audit#Web Security
CVE-2025-55184 React Server Components Infinite Loop DoS: A Single Payload Locks CPU

React Server Components hand “client-sent request parameters” to the deserialization parser — attackers send a specially crafted payload, triggering the RSC parser to enter an infinite loop during deserialization, immediately consuming 100% CPU, and putting the entire service in an unavailable state.

Unlock to view this content.