Security researchers have disclosed two significant new vulnerabilities in React Server Components that expose servers to Denial-of-Service (DoS) attacks and source code leaks.
These flaws were identified by experts analyzing the efficacy of patches released for last week’s critical “React2Shell” vulnerability.
While the newly discovered issues do not enable Remote Code Execution (RCE) as their predecessor did, they still pose substantial risks to application stability, availability, and intellectual property.
The findings highlight the complexity of securing server-side rendering environments where incomplete fixes can leave production systems exposed to new vectors of abuse.
Denial of Service and Source Code Risks
The most severe of the new flaws involves a Denial-of-Service vulnerability rated as High severity. Attackers can exploit this issue by sending a specially crafted HTTP request to a target server endpoint.
When React processes this malicious input, it triggers an infinite loop within the server process. This loop consumes excessive CPU resources, causing the server to hang indefinitely.
In a production environment, this can rapidly cause a complete service outage, leaving the application unavailable to legitimate users and potentially requiring manual intervention to restore service.
The second vulnerability, while rated Medium severity, poses a significant privacy risk due to source code exposure.
Researchers found that under specific conditions, a malicious request could cause a Server Function to return its own source code as a text string rather than execute it.
This behavior could inadvertently leak sensitive business logic, proprietary algorithms, or even internal database keys and API secrets that developers may have embedded directly within the function code.
Threat actors could weaponize such information to craft further targeted attacks against the application’s backend infrastructure.
The React team has confirmed that the updates released earlier this week, specifically versions 19.0.2, 19.1.3, and 19.2.2, are incomplete and remain vulnerable to these new exploits.
The vulnerabilities affect widely used packages, including. react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.
Consequently, popular frameworks that rely on these components, such as Next.js, React Router, and Waku, are also impacted.
Developers who recently updated their systems to address React2Shell must update again immediately to the newly released fixed versions to ensure complete protection.
React Native users employing these server packages in a monorepo setup are advised to update the specific server packages without changing their core React version to avoid version mismatches.
| CVE ID | Severity | CVSS | Vulnerability Type |
|---|---|---|---|
| CVE-2025-55184 | High | 7.5 | Denial of Service (DoS) |
| CVE-2025-67779 | High | 7.5 | Denial of Service (DoS) |
| CVE-2025-55183 | Medium | 5.3 | Source Code Exposure |
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Update
%20(1)%20(1).webp?fit=1600,900&ssl=1&description=These flaws were identified by experts analyzing the efficacy of patches released for last week’s critical "React2Shell" vulnerability.){kind=link}