GHSA-mwv6-3258-q52c

    Dashboard / Vulnerabilities / GHSA-mwv6-3258-q52c

    GHSA-mwv6-3258-q52c

    Published: 11 Dec 2025Last Modified: 10 Sept 2026

    Summary: Next Vulnerable to Denial of Service with Server Components

    Details: A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184). A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.

    References: https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c, https://github.com/vercel/next.js, https://nextjs.org/blog/security-update-2025-12-11, https://www.cve.org/CVERecord?id=CVE-2025-55184

    Affected packages

    Package

    Name: next

    Purl: pkg:npm/next

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 13.3.0
    Fixed -14.2.34

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High