REACT-SERVER-DOM-PARCEL · GHSA-h3gv-c5rc-p453 · Package
FIX → 19.3.1 +3
Specially crafted HTTP requests sent to server function endpoints can trigger out-of-memory errors or excessive CPU use in React Server Components packages. An attacker can make the server slow or crash, which is a denial of service.
first public Oct 14, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Apps that run React Server Components with server functions through webpack, Parcel or Turbopack integrations are exposed, since the flaw sits in the server-side request handling of these packages. Client-only React apps, and apps that use no server or no RSC-capable framework or bundler, are not affected.
Not affected if client-only-react, no-rsc-framework
Who cares next.js, react, react-server-components, self-hosted, turbopack, webpack
react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack with A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.
We recommend updating immediately.
The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of:
Fixes were back ported to versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.
If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack19.0.0 to 19.0.7, 19.1.0 to 19.1.8, and 19.2.0 to 19.2.7; 19.3.0 is affected below 19.3.1Upgrade to 19.3.1 +3
react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack: 19.0.9 for the 19.0 line, 19.1.10 for 19.1, 19.2.9 for 19.2, 19.3.1 for 19.3