Denial of Service in React Server DOM Packages

Executive Summary

This is a denial of service vulnerability in React Server Components packages (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack). Attackers can send specially crafted HTTP requests to server function endpoints, causing excessive CPU usage or out-of-memory exceptions. The vulnerability affects versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system is running affected versions of react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack (19.0.0-19.0.7, 19.1.0-19.1.8, 19.2.0-19.2.7). Use commands like 'npm list react-server-dom-webpack' or 'yarn list react-server-dom-webpack' to verify installed versions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to system unavailability due to excessive CPU usage or crashes from out-of-memory errors. It does not require privileges or user interaction to exploit, making it easier for attackers to disrupt services. Applications not using React Server Components or server functions are unaffected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability by causing excessive CPU usage or out-of-memory exceptions through crafted HTTP requests. While it does not directly expose data, prolonged unavailability could lead to violations of availability requirements in GDPR (Article 32) and HIPAA (Security Rule §164.312). Organizations must ensure timely patching to maintain compliance with these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update affected packages to versions 19.0.8, 19.1.9, or 19.2.8 or later. If updating is not possible, consider disabling React Server Components or server functions if they are not essential to your application.

Useful 0 Not Useful 0