Description
(Medium) Source Code Exposure: CVE-2025-55183
A specifically crafted HTTP request can cause a Server Function to
return the compiled source code of other Server Functions in your
application. This could reveal business logic. Secrets could also be exposed
if they are defined directly in your code (rather than accessed via environment
variables at runtime) and referenced within a Server Function.
Depending on your bundler configuration, these values may be inlined into the
compiled function output.
(High) Denial of Service: CVE-2025-55184
A specifically crafted HTTP request can be sent to any App Router endpoint
that, when deserialized, can cause an infinite loop that hangs the server
process and prevents future HTTP requests from being served.