A high-severity denial of service vulnerability in Meta React Server Components packages allows unauthenticated remote attackers to exhaust system resources and degrade service availability.

This vulnerability involves uncontrolled resource consumption and insecure deserialization, where an unauthenticated attacker can send malicious HTTP requests to Server Function endpoints, forcing the application into a prolonged high-CPU state.

The vulnerability carries a CVSS score of 7.5, reflecting a significant risk to service availability. Successful exploitation allows an attacker to effectively knock a service offline for short durations, causing potential business disruption and reputational damage. As the attack is unauthenticated and automatable, it poses a low barrier to entry for malicious actors seeking to disrupt operations.

Immediate Action: Update the affected packages (react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack) to version 19.0.5, 19.1.6, or 19.2.5 respectively, as provided by the vendor.

Proactive Monitoring: Monitor server CPU utilization metrics for consistent, anomalous spikes lasting up to one minute, and review web server logs for high volumes of traffic directed at Server Function endpoints.

Compensating Controls: Implement rate limiting on sensitive API and Server Function endpoints via a Web Application Firewall (WAF) or load balancer to mitigate the impact of high-frequency malicious requests.

Public Exploit Available: Yes, two public proof-of-concept repositories exist on GitHub.

Given the ease of exploitation and the availability of public proof-of-concept material, administrators should prioritize updating the React Server Component packages to the patched versions immediately. Failure to apply these updates leaves the application infrastructure susceptible to automated denial of service attacks that can significantly impact user experience and system reliability.