React Server Components vulnerabilities

Vulnerability in React Server Components versions 19.0.2, 19.1.3 and 19.2.2 is an incomplete fix for CVE-2025-55184 and still allows unsafe deserialization of payloads from HTTP requests to Server Function endpoints, causing an infinite loop that hangs the server process.

Pre-authentication denial of service vulnerability in React Server Components versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack, allows unsafe deserialization of payloads from HTTP requests to Server Function endpoints, causing an infinite loop that hangs the server process.

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function.

A denial of service vulnerability in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) versions 19.0.0-19.0.4, 19.1.0-19.1.5, and 19.2.0-19.2.4. Specially crafted HTTP requests to Server Function endpoints cause excessive CPU usage for about a minute, ending in a catchable error.

Multiple denial of service vulnerabilities have been found in React Server Components packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack). Specially crafted HTTP requests to Server Function endpoints can cause server crashes, out-of-memory exceptions, or excessive CPU usage.