Executive brief
Multiple denial of service vulnerabilities exist in React Server Components, a technology used to build modern web applications. By sending specially crafted web requests, an attacker can cause the server to crash, run out of memory, or consume excessive processor resources. This can lead to application downtime and service unavailability for customers.
Technical details
The vulnerabilities involve uncontrolled resource consumption (CWE-400) and potentially unsafe deserialization (CWE-502) within React Server Components. An unauthenticated remote attacker can trigger these flaws by sending specially crafted HTTP requests to Server Function endpoints. Depending on the specific code path and application configuration, this can result in server crashes, out-of-memory (OOM) exceptions, or sustained high CPU usage. The issue affects the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages. Patches are available in versions 19.0.4, 19.1.5, and 19.2.4.
Affected products
- Meta react-server-dom-parcel 19.0.0 to 19.0.3, 19.1.0 to 19.1.4, 19.2.0 to 19.2.3
- Meta react-server-dom-turbopack 19.0.0 to 19.0.3, 19.1.0 to 19.1.4, 19.2.0 to 19.2.3
- Meta react-server-dom-webpack 19.0.0 to 19.0.3, 19.1.0 to 19.1.4, 19.2.0 to 19.2.3
- Red Hat Streams for Apache Kafka 3.2.0
Timeline
- 2026-01-26: disclosed
- 2026-01-26: advisory
- 2026-05-04: patched: Red Hat released updates for Streams for Apache Kafka