Headline
GHSA-mwv6-3258-q52c: Next Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184.
A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.
- GitHub Advisory Database
- GitHub Reviewed
- GHSA-mwv6-3258-q52c
Next Vulnerable to Denial of Service with Server Components
High severity GitHub Reviewed Published Dec 11, 2025 in vercel/next.js • Updated Dec 11, 2025
Affected versions
>= 13.3.0, < 14.2.34
>= 15.0.0-canary.0, < 15.0.6
>= 15.1.1-canary.0, < 15.1.10
>= 15.2.0-canary.0, < 15.2.7
>= 15.3.0-canary.0, < 15.3.7
>= 15.4.0-canary.0, < 15.4.9
>= 15.5.1-canary.0, < 15.5.8
>= 15.6.0-canary.0, < 15.6.0-canary.59
>= 16.0.0-beta.0, < 16.0.9
>= 16.1.0-canary.0, < 16.1.0-canary.17
Patched versions
14.2.34
15.0.6
15.1.10
15.2.7
15.3.7
15.4.9
15.5.8
15.6.0-canary.59
16.0.9
16.1.0-canary.17
Published to the GitHub Advisory Database
Dec 11, 2025
Last updated
Dec 11, 2025