React Server Dom Turbopack
Monthly
Denial of service in React's Server Components runtime (react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack) lets remote unauthenticated attackers spike CPU to exhaustion by POSTing specially crafted HTTP requests to Server Function ('use server') endpoints across versions 19.0.0-19.0.7, 19.1.0-19.1.8, and 19.2.0-19.2.7. The flaw was reported by Meta (React's maintainer) and carries CVSS 7.5 (availability-only impact). No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Remote denial of service in React Server Components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) versions 19.0.0-19.0.5, 19.1.0-19.1.6, and 19.2.0-19.2.5 allows unauthenticated remote attackers to crash servers, trigger out-of-memory exceptions, or exhaust CPU resources by sending specially crafted HTTP requests to server function endpoints. The CVSS 7.5 score reflects network-accessible, low-complexity exploitation requiring no privileges or user interaction, with high availability impact. No public exploit code or active exploitation confirmed at time of analysis, though EPSS data unavailable and vulnerability disclosed by Meta directly.
Denial of service in React's Server Components runtime (react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack) lets remote unauthenticated attackers spike CPU to exhaustion by POSTing specially crafted HTTP requests to Server Function ('use server') endpoints across versions 19.0.0-19.0.7, 19.1.0-19.1.8, and 19.2.0-19.2.7. The flaw was reported by Meta (React's maintainer) and carries CVSS 7.5 (availability-only impact). No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Remote denial of service in React Server Components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) versions 19.0.0-19.0.5, 19.1.0-19.1.6, and 19.2.0-19.2.5 allows unauthenticated remote attackers to crash servers, trigger out-of-memory exceptions, or exhaust CPU resources by sending specially crafted HTTP requests to server function endpoints. The CVSS 7.5 score reflects network-accessible, low-complexity exploitation requiring no privileges or user interaction, with high availability impact. No public exploit code or active exploitation confirmed at time of analysis, though EPSS data unavailable and vulnerability disclosed by Meta directly.