-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| react-server-dom-webpack | npm | = 19.0 | 19.0.1 |
| react-server-dom-webpack | npm | >= 19.1.0, < 19.1.2 | 19.1.2 |
| react-server-dom-webpack | npm | = 19.2.0 | 19.2.1 |
| react-server-dom-turbopack | npm | = 19.0 | 19.0.1 |
| react-server-dom-turbopack | npm | >= 19.1.0, < 19.1.2 | 19.1.2 |
| react-server-dom-turbopack | npm | = 19.2.0 | 19.2.1 |
| react-server-dom-parcel | npm | = 19.0 | 19.0.1 |
| react-server-dom-parcel | npm | >= 19.1.0, < 19.1.2 | 19.1.2 |
| react-server-dom-parcel | npm | = 19.2.0 | 19.2.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Remote Code Execution (RCE) in React Server Components, caused by insecure deserialization of data sent from the client to the server. An attacker can craft a malicious request to a server action endpoint.
The server-side code uses a function, decodeReplyFromBusboy, to parse this request. The core of the vulnerability lies in the ReactFlightReplyServer.js file, which contains the logic for deserializing the client's request and executing server-side functions.
The reviveModel function recursively reconstructs JavaScript objects from the parsed JSON payload. The original implementation was vulnerable to prototype pollution, allowing an attacker to inject a __proto__ key in the payload to modify Object.prototype.
This prototype pollution is then leveraged by loadServerReference, which is responsible for loading and executing the server function requested by the client. This function uses requireModule to load the function's code. The requireModule function was also vulnerable, as it accessed properties on a module object without checking if they were its own properties. An attacker could exploit the polluted prototype to make requireModule execute arbitrary code.
The patch addresses these issues by:
hasOwnProperty checks in requireModule to prevent prototype pollution.ReactFlightReplyServer.js, particularly in reviveModel and loadServerReference, to handle object creation and cycles securely.decodeReplyFromBusboy to prevent crashes from malformed payloads.requireModulepackages/react-server-dom-parcel/src/client/ReactFlightClientConfigBundlerParcel.js
requireModulepackages/react-server-dom-turbopack/src/client/ReactFlightClientConfigBundlerTurbopack.js
requireModulepackages/react-server-dom-webpack/src/client/ReactFlightClientConfigBundlerNode.js
requireModulepackages/react-server-dom-webpack/src/client/ReactFlightClientConfigBundlerWebpack.js
reviveModelpackages/react-server/src/ReactFlightReplyServer.js
loadServerReferencepackages/react-server/src/ReactFlightReplyServer.js
decodeReplyFromBusboypackages/react-server-dom-webpack/src/server/ReactFlightDOMServerNode.js