A critical, unauthenticated denial of service vulnerability in React Server Components packages allows remote attackers to crash server processes via malicious HTTP requests.

This vulnerability arises from the unsafe deserialization of untrusted data within HTTP requests directed at Server Function endpoints. An unauthenticated attacker can exploit this flaw to trigger an infinite loop, causing uncontrolled resource consumption that hangs the server process and denies service to legitimate users.

The ability for an unauthenticated remote attacker to completely halt application availability poses a severe risk to business continuity. Because the exploit vector is network-based and requires no privileges, it is highly accessible to threat actors. Given the CVSS score of 7.5 and the critical nature of core infrastructure components in modern web applications, the potential for widespread service disruption and reputational damage is significant.

Immediate Action: Update all affected packages (react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack) to version 19.0.2, 19.1.3, or 19.2.2 as appropriate for your current baseline.

Proactive Monitoring: Review web server and application logs for anomalous spikes in traffic directed at Server Function endpoints, specifically looking for requests that result in process timeouts or high CPU usage.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming HTTP payloads for suspicious serialized data structures, though this may provide incomplete protection due to the complexity of the deserialization flaw.

Public Exploit Available: Yes — multiple public proof-of-concept repositories exist on GitHub.

This vulnerability represents a high-risk exposure due to its ease of exploitation and the critical impact on application availability. Organizations utilizing React 19 should prioritize the update to the patched versions immediately to prevent potential service outages. Failure to patch leaves your infrastructure susceptible to trivial denial of service attacks that can be automated by remote adversaries.