---
title: "CVE-2025-55184 & CVE-2025-55183: Next.js DoS and Source Code Exposure"
description: "High-severity Denial of Service and medium-severity Source Code Exposure vulnerabilities in React Server Components. Immediate update required."
date: 2024-12-13
author: DjangoCFG Team
tags: [security, nextjs, high]
---

import { Callout, Steps } from 'nextra/components'

# CVE-2025-55184 & CVE-2025-55183: Next.js Vulnerabilities

<Callout type="error">
**CVE-2025-55184: CVSS 7.5 (High)** — Denial of Service vulnerability
**CVE-2025-55183: CVSS 5.3 (Medium)** — Source Code Exposure vulnerability
</Callout>

**Published:** December 12, 2024
**Affected:** Next.js 13.x, 14.x, 15.x, 16.x
**Fixed in:** 15.5.9, 15.4.10, 15.3.8, 15.2.8, 15.1.11, 15.0.7, 16.0.10, 14.2.35

## Summary

Following the React2Shell disclosure, increased community research into React Server Components surfaced two additional vulnerabilities:

- **CVE-2025-55184 (High):** Denial of Service - malicious HTTP requests can cause the server process to hang and consume CPU
- **CVE-2025-55183 (Medium):** Source Code Exposure - malicious HTTP requests can return compiled source code of Server Actions

**Important:** Neither of these vulnerabilities allow for Remote Code Execution.

## Impact

### CVE-2025-55184: Denial of Service

A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU resources, potentially making the application unavailable.

### CVE-2025-55183: Source Code Exposure

A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Actions. This could reveal business logic, but would **not expose secrets** unless they were hardcoded directly into the Server Action's code.

## Affected Versions

| Status | Versions | Fixed In |
|--------|----------|----------|
| **Affected** | Next.js 15.5.x | 15.5.9 |
| **Affected** | Next.js 15.4.x | 15.4.10 |
| **Affected** | Next.js 15.3.x | 15.3.8 |
| **Affected** | Next.js 15.2.x | 15.2.8 |
| **Affected** | Next.js 15.1.x | 15.1.11 |
| **Affected** | Next.js 15.0.x | 15.0.7 |
| **Affected** | Next.js 16.0.x | 16.0.10 |
| **Affected** | Next.js 14.x | 14.2.35 |
| **Affected** | Next.js 13.3+ | 14.2.35 |
| **Not Affected** | Pages Router | N/A |

<Callout type="info">
Next.js Pages Router applications are **not affected** by these vulnerabilities.
</Callout>

## Required Action

<Steps>
### Check your Next.js version

```bash
npm list next
# or
pnpm list next
# or check in browser console
next.version
```

### Update to the patched version

```bash
# For 15.5.x (recommended)
npm install next@15.5.9

# For other versions
npm install next@15.4.10   # for 15.4.x
npm install next@15.3.8    # for 15.3.x
npm install next@15.2.8    # for 15.2.x
npm install next@15.1.11   # for 15.1.x
npm install next@15.0.7    # for 15.0.x
npm install next@16.0.10   # for 16.0.x
npm install next@14.2.35   # for 14.x and 13.3+
```

### Update lockfile and rebuild

```bash
# Update lockfile
npm install  # or pnpm install

# Rebuild
npm run build

# Deploy immediately
# Deploy to your hosting provider
```
</Steps>

<Callout type="warning">
**Immediate deployment required** — These vulnerabilities affect all App Router endpoints. Deploy the patched version as soon as possible.
</Callout>

## DjangoCFG Packages Status

All `@djangocfg/*` packages have been updated to require Next.js 15.5.9+:

| Package | Previous | Updated |
|---------|----------|---------|
| `@djangocfg/nextjs` | 15.5.7 | **15.5.9** |
| `@djangocfg/ui-nextjs` | 15.5.7 | **15.5.9** |
| `@djangocfg/layouts` | >=15.0.0 | Compatible |
| All apps | 15.5.7 | **15.5.9** |

Update your packages:

```bash
pnpm update @djangocfg/nextjs @djangocfg/ui-nextjs
```

## Vercel WAF Protection

Vercel has deployed new WAF rules to automatically protect all projects hosted on Vercel at no cost. However, **WAF rules cannot guarantee protection against all possible variants** — immediate upgrades are still required.

## Additional Security Measures

<Steps>
### Enable Deployment Protection

Turn on [Standard Protection](https://vercel.com/docs/security/deployment-protection) for all deployments besides your production domain to prevent exploitation of older deployments.

### Audit Shareable Links

Review any shareable preview deployment links to ensure they are not publicly accessible without protection.

### Rotate Secrets (Optional)

Only recommended if secrets were hardcoded in Server Actions. Use environment variables instead:

```bash
# Good - uses env var
const API_KEY = process.env.API_KEY;

// Bad - hardcoded (would be exposed by CVE-2025-55183)
const API_KEY = "sk-...";
```
</Steps>

## References

- [Next.js Security Advisory](https://nextjs.org/blog/security-update-2025-12-11)
- [Vercel Security Bulletin](https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183)
- [React Blog Post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components)

## Timeline

| Date | Event |
|------|-------|
| Dec 12, 2024 | Vulnerabilities disclosed |
| Dec 12, 2024 | Patched versions released |
| Dec 12, 2024 | Vercel WAF rules deployed |
| Dec 13, 2024 | DjangoCFG packages updated |

---

*These vulnerabilities were discovered through increased community research following the React2Shell disclosure. We are grateful to the security community for helping strengthen the ecosystem.*
