A critical denial of service vulnerability in React Server Components allows unauthenticated remote attackers to hang server processes via malicious payload deserialization.

The vulnerability stems from improper deserialization of untrusted data (CWE-502) in Server Function endpoints, which triggers uncontrolled resource consumption (CWE-400). Unauthenticated attackers can send specifically crafted HTTP requests that cause an infinite loop, effectively crashing the server process.

Successful exploitation results in a complete denial of service for the affected React application, rendering it unavailable to legitimate users. Given the high CVSS score of 7.5 and the ease of exploitation (no authentication required), this poses a significant risk to business continuity and service reliability. Prolonged downtime may result in substantial operational disruption and potential reputational damage.

Immediate Action: Update the affected packages (react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack) to versions 19.0.3, 19.1.4, or 19.2.3 immediately.

Proactive Monitoring: Monitor server logs for an unusual spike in HTTP 500 errors or process hangs, and track resource utilization metrics for unexpected CPU exhaustion on Server Function endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and validate request payloads directed at server-side endpoints, though patching remains the only definitive mitigation.

Public Exploit Available: Unknown

This vulnerability represents a significant stability risk to applications utilizing React Server Components. Given the ease with which an unauthenticated actor can trigger a system-wide hang, organizations should prioritize the deployment of the provided patches in their next maintenance cycle. Failure to update leaves the infrastructure susceptible to trivial denial of service attacks that can disrupt critical business operations.