React Server Components Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in React Server Components, specifically in the packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. This vulnerability can be triggered by sending specially crafted HTTP requests to Server Function endpoints, potentially leading to server crashes, out-of-memory exceptions, or excessive CPU usage. The impact varies depending on the vulnerable code path, application configuration, and application code.

Impact

Exploitation of this vulnerability can cause server crashes, out-of-memory exceptions, or excessive CPU usage, leading to availability issues in applications using React Server Components.

Remediation

Users are strongly advised to upgrade to the latest package versions to reduce risk and prevent availability issues.