{"id":"GHSA-h3gv-c5rc-p453","kind":"vulnerability","aliases":["GHSA-h3gv-c5rc-p453"],"related":[],"title":"Denial of Service in Server Functions","description":"### Impact\r\n\r\nA denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.\r\n\r\nWe recommend updating immediately.\r\n\r\nThe vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of:\r\n\r\n- react-server-dom-webpack\r\n- react-server-dom-parcel\r\n- react-server-dom-turbopack\r\n\r\n### Patches\r\n\r\nFixes were back ported to versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.\r\n\r\nIf you are using any of the above packages please upgrade to any of the fixed versions immediately.\r\n\r\nIf your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.","summary":"Specially crafted HTTP requests sent to server function endpoints can trigger out-of-memory errors or excessive CPU use in React Server Components packages. An attacker can make the server slow or crash, which is a denial of service.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"react-server-dom-parcel","fixed":["19.0.9","19.1.10","19.2.9","19.3.1"],"affected":">= 19.0.0, < 19.0.9; >= 19.1.0, < 19.1.10; >= 19.2.0, < 19.2.9; >= 19.3.0, < 19.3.1","ecosystem":"npm"},{"name":"react-server-dom-turbopack","fixed":["19.0.9","19.1.10","19.2.9","19.3.1"],"affected":">= 19.0.0, < 19.0.9; >= 19.1.0, < 19.1.10; >= 19.2.0, < 19.2.9; >= 19.3.0, < 19.3.1","ecosystem":"npm"},{"name":"react-server-dom-webpack","fixed":["19.0.9","19.1.10","19.2.9","19.3.1"],"affected":">= 19.0.0, < 19.0.9; >= 19.1.0, < 19.1.10; >= 19.2.0, < 19.2.9; >= 19.3.0, < 19.3.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["next.js","package","react","react-server-components","self-hosted","turbopack","webpack"],"not_affected_if":["client-only-react","no-rsc-framework"],"how_to_check":"- Check the installed version of `react-server-dom-webpack`, `react-server-dom-parcel` and `react-server-dom-turbopack` with `npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack`\n- Affected ranges are `19.0.0` to `19.0.7`, `19.1.0` to `19.1.8`, and `19.2.0` to `19.2.7`; `19.3.0` is affected below `19.3.1`\n- Apps that do not use a server, a framework, bundler or bundler plugin with React Server Components are not affected, per the advisory","fix":"- `react-server-dom-webpack`, `react-server-dom-parcel`, `react-server-dom-turbopack`: `19.0.9` for the 19.0 line, `19.1.10` for 19.1, `19.2.9` for 19.2, `19.3.1` for 19.3","status":"open","published_at":"2026-10-14T17:08:23+00:00","first_seen_at":"2026-11-09T22:53:13+00:00","triaged_at":"2026-11-09T22:54:11+00:00","updated_at":"2026-11-09T22:54:11+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:54:11Z","model":"claude-haiku-5-5","output":{"fix":"- `react-server-dom-webpack`, `react-server-dom-parcel`, `react-server-dom-turbopack`: `19.0.9` for the 19.0 line, `19.1.10` for 19.1, `19.2.9` for 19.2, `19.3.1` for 19.3","reach":"internet","title":"React Server Components: crafted HTTP requests exhaust memory or CPU","impact":"medium","summary":"Specially crafted HTTP requests sent to server function endpoints can trigger out-of-memory errors or excessive CPU use in React Server Components packages. An attacker can make the server slow or crash, which is a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["react","react-server-components","next.js","self-hosted","webpack","turbopack"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Server becomes unresponsive through memory exhaustion or CPU saturation","analyst_note":"","how_to_check":"- Check the installed version of `react-server-dom-webpack`, `react-server-dom-parcel` and `react-server-dom-turbopack` with `npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack`\n- Affected ranges are `19.0.0` to `19.0.7`, `19.1.0` to `19.1.8`, and `19.2.0` to `19.2.7`; `19.3.0` is affected below `19.3.1`\n- Apps that do not use a server, a framework, bundler or bundler plugin with React Server Components are not affected, per the advisory","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["client-only-react","no-rsc-framework"],"who_is_affected":"Apps that run React Server Components with server functions through webpack, Parcel or Turbopack integrations are exposed, since the flaw sits in the server-side request handling of these packages. Client-only React apps, and apps that use no server or no RSC-capable framework or bundler, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000888,"input_tokens":5132,"output_tokens":750,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'19.0.0':125C '19.0.7':127C '19.0.9':158C '19.1.0':128C '19.1.10':159C '19.1.8':130C '19.2.0':132C '19.2.7':134C '19.2.9':160C '19.3.1':162C 'affect':196C,221C 'app':183C,193C,202C,218C 'attack':70B 'back':154C 'bundler':208C,210C 'c5rc':10A,15A 'code':186C 'compon':38B,67B,216C 'could':90C,104C 'cpu':62B,114C 'craft':45B,96C 'crash':77B 'denial':1A,81B,86C 'dom':20A,25A,30A,139C,144C,149C 'endpoint':52B,102C 'error':59B 'except':111C 'excess':61B,113C 'exist':122C 'fix':152C,178C 'framework':207C 'function':6A,51B,101C 'ghsa':8A,13A 'ghsa-h3gv-c5rc-p453':7A,12A 'h3gv':9A,14A 'host':41B 'http':46B,97C 'immedi':119C,180C 'impact':84C 'lead':105C 'make':72B 'memori':58B,110C 'next.js':32B 'out-of-memori':55B,107C 'p453':11A,16A 'packag':33B,68B,171C 'parcel':21A,145C 'patch':151C 'pleas':172C 'plugin':211C 'port':155C 'react':18A,23A,28A,34B,36B,65B,137C,142C,147C,185C,214C 'react-server-compon':35B 'react-server-dom-parcel':17A,141C 'react-server-dom-turbopack':22A,146C 'react-server-dom-webpack':27A,136C 'recommend':117C 'request':47B,98C 'self':40B 'self-host':39B 'send':94C 'sent':48B 'server':5A,19A,24A,29A,37B,50B,66B,74B,100C,138C,143C,148C,191C,215C 'servic':3A,83B,88C 'slow':75B 'special':44B,95C 'support':213C 'trigger':54B,92C 'turbopack':26A,42B,150C 'updat':118C 'upgrad':173C 'usag':115C 'use':63B,166C,189C,205C 'version':124C,157C,179C 'vulner':89C,121C,199C,224C 'webpack':31A,43B,140C","nicknames":[],"mitigations":[],"who_affected":"Apps that run React Server Components with server functions through webpack, Parcel or Turbopack integrations are exposed, since the flaw sits in the server-side request handling of these packages. Client-only React apps, and apps that use no server or no RSC-capable framework or bundler, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["reactserverdomparcel","reactserverdomturbopack","reactserverdomwebpack"],"ptokens":["dom","parcel","react","server","turbopack","webpack"],"labels":["high","nextjs","npm","package","react","reactservercomponents","selfhosted","turbopack","webpack"],"campaign_type":null,"search_a":"'c5rc':10A,15A 'denial':1A 'dom':20A,25A,30A 'function':6A 'ghsa':8A,13A 'ghsa-h3gv-c5rc-p453':7A,12A 'h3gv':9A,14A 'p453':11A,16A 'parcel':21A 'react':18A,23A,28A 'react-server-dom-parcel':17A 'react-server-dom-turbopack':22A 'react-server-dom-webpack':27A 'server':5A,19A,24A,29A 'servic':3A 'turbopack':26A 'webpack':31A","search_b":"'attack':70B 'compon':38B,67B 'cpu':62B 'craft':45B 'crash':77B 'denial':81B 'endpoint':52B 'error':59B 'excess':61B 'function':51B 'host':41B 'http':46B 'make':72B 'memori':58B 'next.js':32B 'out-of-memori':55B 'packag':33B,68B 'react':34B,36B,65B 'react-server-compon':35B 'request':47B 'self':40B 'self-host':39B 'sent':48B 'server':37B,50B,66B,74B 'servic':83B 'slow':75B 'special':44B 'trigger':54B 'turbopack':42B 'use':63B 'webpack':43B","search_c":"'19.0.0':125C '19.0.7':127C '19.0.9':158C '19.1.0':128C '19.1.10':159C '19.1.8':130C '19.2.0':132C '19.2.7':134C '19.2.9':160C '19.3.1':162C 'affect':196C,221C 'app':183C,193C,202C,218C 'back':154C 'bundler':208C,210C 'code':186C 'compon':216C 'could':90C,104C 'cpu':114C 'craft':96C 'denial':86C 'dom':139C,144C,149C 'endpoint':102C 'except':111C 'excess':113C 'exist':122C 'fix':152C,178C 'framework':207C 'function':101C 'http':97C 'immedi':119C,180C 'impact':84C 'lead':105C 'memori':110C 'out-of-memori':107C 'packag':171C 'parcel':145C 'patch':151C 'pleas':172C 'plugin':211C 'port':155C 'react':137C,142C,147C,185C,214C 'react-server-dom-parcel':141C 'react-server-dom-turbopack':146C 'react-server-dom-webpack':136C 'recommend':117C 'request':98C 'send':94C 'server':100C,138C,143C,148C,191C,215C 'servic':88C 'special':95C 'support':213C 'trigger':92C 'turbopack':150C 'updat':118C 'upgrad':173C 'usag':115C 'use':166C,189C,205C 'version':124C,157C,179C 'vulner':89C,121C,199C,224C 'webpack':140C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-14T17:08:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-h3gv-c5rc-p453","url":"https://github.com/react/react/security/advisories/GHSA-h3gv-c5rc-p453","severity":"high","published_at":"2026-10-14T17:08:23+00:00","modified_at":"2026-10-14T17:08:23+00:00","first_seen_at":"2026-11-09T22:53:13+00:00","fetched_at":"2026-11-09T22:53:13+00:00","note":null}],"documents":[{"id":110389,"url":"https://github.com/react/react/security/advisories/GHSA-h3gv-c5rc-p453","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}