Following community security research into React Server Components, we deployed fixes for two newly disclosed vulnerabilities affecting our Next.js infrastructure.
What we fixed
Denial of service (high severity; CVE-2025-55184, CVE-2025-67779). Patched a vulnerability where malicious HTTP requests could hang server processes and consume excessive CPU, across all payload types.
Source code exposure (medium severity; CVE-2025-55183). Closed a vulnerability that could expose compiled Server Action source code through malicious requests.
Background
External researchers found these issues through Vercel and Meta’s bug bounty program, following the React2Shell incident. There is no evidence that they were exploited.
No action is needed. The patches are deployed across all Babbily infrastructure.