{"id":"GHSA-mwv6-3258-q52c","summary":"Next Vulnerable to Denial of Service with Server Components","details":"A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).\n\nA malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.","modified":"2026-09-10T03:50:31.942194779Z","published":"2025-12-11T22:49:27Z","database_specific":{"github_reviewed_at":"2025-12-11T22:49:27Z","nvd_published_at":null,"cwe_ids":["CWE-1395","CWE-400","CWE-502"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c"},{"type":"PACKAGE","url":"https://github.com/vercel/next.js"},{"type":"WEB","url":"https://nextjs.org/blog/security-update-2025-12-11"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2025-55184"}],"affected":[{"package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.3.0"},{"fixed":"14.2.34"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mwv6-3258-q52c/GHSA-mwv6-3258-q52c.json"}},{"package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"15.0.0-canary.0"},{"fixed":"15.0.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mwv6-3258-q52c/GHSA-mwv6-3258-q52c.json"}},{"package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mwv6-3258-q52c/GHSA-mwv6-3258-q52c.json"}},{"package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mwv6-3258-q52c/GHSA-mwv6-3258-q52c.json"}},{"package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mwv6-3258-q52c/GHSA-mwv6-3258-q52c.json"}},{"package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mwv6-3258-q52c/GHSA-mwv6-3258-q52c.json"}},{"package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mwv6-3258-q52c/GHSA-mwv6-3258-q52c.json"}},{"package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.59"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mwv6-3258-q52c/GHSA-mwv6-3258-q52c.json"}},{"package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mwv6-3258-q52c/GHSA-mwv6-3258-q52c.json"}},{"package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.0-canary.17"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mwv6-3258-q52c/GHSA-mwv6-3258-q52c.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}