---
id: "GHSA-h3gv-c5rc-p453"
page: "https://infrastack.ai/live/GHSA-h3gv-c5rc-p453"
kind: "vulnerability"
aliases: ["GHSA-h3gv-c5rc-p453"]
title: "Denial of Service in Server Functions"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "react-server-dom-parcel", "fixed": ["19.0.9", "19.1.10", "19.2.9", "19.3.1"], "affected": ">= 19.0.0, < 19.0.9; >= 19.1.0, < 19.1.10; >= 19.2.0, < 19.2.9; >= 19.3.0, < 19.3.1", "ecosystem": "npm"}, {"name": "react-server-dom-turbopack", "fixed": ["19.0.9", "19.1.10", "19.2.9", "19.3.1"], "affected": ">= 19.0.0, < 19.0.9; >= 19.1.0, < 19.1.10; >= 19.2.0, < 19.2.9; >= 19.3.0, < 19.3.1", "ecosystem": "npm"}, {"name": "react-server-dom-webpack", "fixed": ["19.0.9", "19.1.10", "19.2.9", "19.3.1"], "affected": ">= 19.0.0, < 19.0.9; >= 19.1.0, < 19.1.10; >= 19.2.0, < 19.2.9; >= 19.3.0, < 19.3.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["next.js", "package", "react", "react-server-components", "self-hosted", "turbopack", "webpack"]
not_affected_if: ["client-only-react", "no-rsc-framework"]
published_at: "2026-10-14T17:08:23+00:00"
first_seen_at: "2026-11-09T22:53:13+00:00"
updated_at: "2026-11-09T22:54:11+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/react/react/security/advisories/GHSA-h3gv-c5rc-p453", "first_seen_at": "2026-11-09T22:53:13+00:00"}]
exploit_sources: []
---

# Denial of Service in Server Functions

Link for people: https://infrastack.ai/live/GHSA-h3gv-c5rc-p453 (this .md is for agents)

Specially crafted HTTP requests sent to server function endpoints can trigger out-of-memory errors or excessive CPU use in React Server Components packages. An attacker can make the server slow or crash, which is a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:react-server-dom-parcel affected >= 19.0.0, < 19.0.9; >= 19.1.0, < 19.1.10; >= 19.2.0, < 19.2.9; >= 19.3.0, < 19.3.1 fixed 19.0.9, 19.1.10, 19.2.9, 19.3.1
- npm:react-server-dom-turbopack affected >= 19.0.0, < 19.0.9; >= 19.1.0, < 19.1.10; >= 19.2.0, < 19.2.9; >= 19.3.0, < 19.3.1 fixed 19.0.9, 19.1.10, 19.2.9, 19.3.1
- npm:react-server-dom-webpack affected >= 19.0.0, < 19.0.9; >= 19.1.0, < 19.1.10; >= 19.2.0, < 19.2.9; >= 19.3.0, < 19.3.1 fixed 19.0.9, 19.1.10, 19.2.9, 19.3.1

## How to check

- Check the installed version of `react-server-dom-webpack`, `react-server-dom-parcel` and `react-server-dom-turbopack` with `npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack`
- Affected ranges are `19.0.0` to `19.0.7`, `19.1.0` to `19.1.8`, and `19.2.0` to `19.2.7`; `19.3.0` is affected below `19.3.1`
- Apps that do not use a server, a framework, bundler or bundler plugin with React Server Components are not affected, per the advisory

## Fix

- `react-server-dom-webpack`, `react-server-dom-parcel`, `react-server-dom-turbopack`: `19.0.9` for the 19.0 line, `19.1.10` for 19.1, `19.2.9` for 19.2, `19.3.1` for 19.3

## Timeline

- 2026-11-09T22:53:13+00:00 ghsa-repo https://github.com/react/react/security/advisories/GHSA-h3gv-c5rc-p453

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/react/react/security/advisories/GHSA-h3gv-c5rc-p453

## From the sources

### Impact

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of:

- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack

### Patches

Fixes were back ported to versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_