Executive summary
We have been notified by our partners about a couple of newly disclosed vulnerabilities that are affecting multiple React-based frameworks.
Akamai has deployed Akamai Adaptive Security Engine Rapid Rules to protect our customers from these threats. For Guardicore customers subscribed to Akamai Hunt, Akamai has searched for and identified relevant vulnerable assets in customer environments and provided recommendations to protect those assets.
Vulnerability details
Two new vulnerabilities have been found in React Server Component (RSC) frameworks:
- CVE-2025-55183 — Information disclosure: Attackers can coerce arguments in server functions to leak server-only source code if input isn’t properly validated.
- CVE-2025-55184 — Function-level denial of service (DoS): Specially crafted payloads can freeze Node.js servers by creating infinite promise recursion, and take affected servers offline.
Mitigation with Akamai App & API Protector
On December 10, 2025, Akamai deployed Adaptive Security Engine Rapid Rules for App & API Protector customers to provide full coverage:
3000977 — Information Leakage In React Vulnerability Detected (CVE-2025-55183)
3000978 — Denial of Service In React Vulnerability Detected (CVE-2025-55184)
Summary
Akamai has deployed new rules within App & API Protector to protect our customers from the newly disclosed vulnerabilities that are affecting multiple React-based frameworks.
Akamai Hunt customers benefit from continuous 24/7 monitoring for new and high-severity vulnerabilities, such as this one, as well as from targeted recommendations for virtual patching through Guardicore's granular microsegmentation capabilities.
Guardicore customers with Insight can identify vulnerable assets by using the appropriate query:
SELECT name, version
FROM npm_packages
WHERE LOWER(name) IN ('react', 'react-dom', 'react-server-dom-webpack', 'react-server-dom-parcel', 'react-server-dom-turbopack')
AND version IN ('19.0.0', '19.1.0', '19.1.1', '19.2.0')
UNION ALL
SELECT name, version
FROM npm_packages
WHERE LOWER(name) = 'next'
AND ((version LIKE '15.%' AND version < '15.1.3') OR version LIKE '16.%' OR version >= '14.3.0-canary.77');Stay tuned
The Akamai Security Intelligence Group will continue to monitor, report on, and create mitigations for threats such as these for both our customers and the security community at large. To keep up with more breaking news from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.
Tags
