AIKIDO-2026-708401

react-server-dom-turbopack is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)GHSA-h3gv-c5rc-p453 Published Yesterday

High Risk

This Affects:

react-server-dom-turbopack

19.0.0 - 19.0.8

Fixed in 19.0.9

19.1.0 - 19.1.9

Fixed in 19.1.10

19.2.0 - 19.2.8

Fixed in 19.2.9

19.3.0 - 19.3.0

Fixed in 19.3.1

Are you affected? Scan for Free

TL;DR

react-server-dom-turbopack can be driven into out-of-memory exceptions or excessive CPU usage by crafted HTTP requests to Server Function endpoints. Applications that do not run React on a server, or that do not use a framework, bundler, or bundler plugin supporting React Server Components, are not affected. The fix limits how large nested arrays, strings, typed arrays, and integers can grow while a Server Function reply is decoded, and it caps how many arguments can be bound to a Server Function.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application uses React Server Components. Applications that do not run React code on the server, or that do not use a framework, bundler, or bundler plugin supporting React Server Components, are not affected.

Background info

react-server-dom-turbopack is vulnerable to Denial of Service (DoS) in versions 19.0.0 - 19.0.8, 19.1.0 - 19.1.9, 19.2.0 - 19.2.8 and 19.3.0 - 19.3.0.