--- title: "React / Next.js Denial-of-Service Vulnerability: Deno Deploy users protected" url: https://daily.dev/posts/react-next-js-denial-of-service-vulnerability-deno-deploy-users-protected-nah4uuqa6 source_url: https://deno.com/blog/cve-2025-55184 type: article source: "Deno" published: 2025-12-11T22:15:27.085Z updated: 2026-02-27T16:59:36.501Z tags: ["security", "webdev", "react", "nextjs", "deno"] reading_time: 4 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # React / Next.js Denial-of-Service Vulnerability: Deno Deploy users protected **[Deno](https://daily.dev/sources/deno)** · 4 min read · 0 upvotes · 0 comments ## Summary A high severity DoS vulnerability (CVE-2025-55184) has been discovered in React Server Components and Next.js that allows attackers to hang servers through crafted HTTP requests causing infinite loops. The vulnerability affects Next.js 13.3+, 14, 15, and 16 using App Router, as well as applications using React Router RSC, Waku, Parcel RSC, Vite RSC, and RedwoodSDK. Deno Deploy has implemented runtime-level mitigations to protect hosted applications automatically. All other users must immediately upgrade to patched versions: Next.js 16.0.9+, 15.5.8+, or 14.2.34+, and React Server Components libraries to 19.2.2+. This is separate from the previously disclosed RCE vulnerability and requires a new upgrade. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [React Server Functions / Next.js Vulnerability: Deno Deploy users protected](https://daily.dev/posts/react-server-functions-next-js-vulnerability-deno-deploy-users-protected-8soqpt9n5) · Deno · 1 upvotes · 0 comments - [Summary of CVE-2026-23869](https://daily.dev/posts/summary-of-cve-2026-23869-acid9blwb) · Vercel · 76 upvotes · 2 comments --- Tags: [#security](https://daily.dev/tags/security), [#webdev](https://daily.dev/tags/webdev), [#react](https://daily.dev/tags/react), [#nextjs](https://daily.dev/tags/nextjs), [#deno](https://daily.dev/tags/deno) [View this post on daily.dev](https://daily.dev/posts/react-next-js-denial-of-service-vulnerability-deno-deploy-users-protected-nah4uuqa6)