Executive brief
A vulnerability in Facebook's React Server Components can allow an attacker to crash a web application or make it unresponsive. By sending specifically designed web requests to the server, an attacker can force the application to consume all available memory or processor power. This results in a denial of service, preventing legitimate users from accessing the site or its features. Applications using modern React frameworks like Next.js are primarily at risk and should be updated immediately.
Technical details
A denial of service vulnerability exists in React Server Components (RSC) due to uncontrolled resource consumption (CWE-400) during the deserialization of server function endpoints. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP requests to these endpoints, triggering out-of-memory (OOM) exceptions or excessive CPU utilization. The flaw specifically impacts the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages. Downstream frameworks such as Next.js (App Router) and Vite plugins that vendor these packages are also affected. Patches have been released in React versions 19.0.6, 19.1.7, and 19.2.6, as well as corresponding framework updates.
Affected products
- Facebook react-server-dom-webpack 19.0.0 - 19.0.5, 19.1.0 - 19.1.6, 19.2.0 - 19.2.5
- Facebook react-server-dom-parcel 19.0.0 - 19.0.5, 19.1.0 - 19.1.6, 19.2.0 - 19.2.5
- Facebook react-server-dom-turbopack 19.0.0 - 19.0.5, 19.1.0 - 19.1.6, 19.2.0 - 19.2.5
- Vercel next.js >= 13.0.0, < 15.5.16; >= 16.0.0, < 16.2.5
- Vite @vitejs/plugin-rsc <= 0.5.25
Timeline
- 2026-05-06: disclosed: Initial disclosure and NVD receipt
- 2026-05-11: advisory: GitHub Advisory published and reviewed
References
- https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh
- https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj
- https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-w94c-4vhp-22gx
- https://api.github.com/repos/facebook/react/security-advisories/GHSA-rv78-f8rc-xrxh