Threat Intelligence / CVE / CVE-2025-67779

CVE-2025-67779

CVSS 7.5 (HIGH) · EPSS 0.2% · Priority 5.3/10 · Published 2025-12-12

As of 2025-12-12, CVE-2025-67779 is a CVSS 7.5 (HIGH-severity) vulnerability. EPSS exploitation probability 0.2%. Threadlinqs Intelligence tracks 1 threat exploiting it.

Last updated: 2025-12-12

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-502, CWE-400

Threats tracking this CVE

React2Shell CVE-2025-55182 — Multiple Threat Actors Actively Exploiting React Server Components RCE (CVSS 10.0) — CRITICAL

References

Full detection coverage & IOCs for threats exploiting CVE-2025-67779 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.