-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| react-server-dom-parcel | npm | >= 19.0.0, < 19.0.2 | 19.0.2 |
| react-server-dom-turbopack | npm | >= 19.0.0, < 19.0.2 | 19.0.2 |
| react-server-dom-webpack | npm | >= 19.0.0, < 19.0.2 | 19.0.2 |
| react-server-dom-parcel | npm | >= 19.1.0, < 19.1.3 | 19.1.3 |
| react-server-dom-parcel | npm | >= 19.2.0, < 19.2.2 | 19.2.2 |
| react-server-dom-turbopack | npm | >= 19.1.0, < 19.1.3 | 19.1.3 |
| react-server-dom-turbopack | npm | >= 19.2.0, < 19.2.2 | 19.2.2 |
| react-server-dom-webpack | npm | >= 19.1.0, < 19.1.3 | 19.1.3 |
| react-server-dom-webpack | npm | >= 19.2.0, < 19.2.2 | 19.2.2 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Denial of Service in React Server Components, categorized under CWE-400 (Uncontrolled Resource Consumption) and CWE-502 (Deserialization of Untrusted Data). The root cause lies in the improper handling of specially crafted payloads during deserialization on the server.
The analysis of the patch commit ac60e735881439ae074706e194fd22781805411f reveals two main attack vectors that were fixed:
Promise/Thenable Cycles: The primary vector was the possibility of creating a cyclic promise (a "thenable" that resolves to itself) within the serialized data. The deserialization logic in packages/react-server/src/ReactFlightReplyServer.js would enter an infinite loop when trying to resolve such a promise. The functions ReactPromise.then, fulfillReference, and getOutlinedModel were directly involved in this looping behavior. The patch mitigates this by adding explicit cycle detection within ReactPromise.then and removing the vulnerable looping logic from fulfillReference and getOutlinedModel. Furthermore, checks were added to loadServerReference and createModel to prevent the creation of malicious promise-like objects from properties named "then".
Resource Re-initialization: The second vector involved the repeated initialization of resources like TypedArrays and Streams. The functions parseTypedArray, parseReadableStream, and parseAsyncIterable could be tricked into processing the same resource ID multiple times. This would lead to unnecessary resource allocation and processing, eventually causing a Denial of Service. The patch addresses this by adding checks to ensure that a resource ID is only initialized once.
The identified vulnerable functions are all part of the server-side deserialization pipeline in ReactFlightReplyServer.js. An unauthenticated attacker could send a malicious payload to a server using React Server Components, triggering these vulnerabilities and causing the server to become unresponsive.
ReactPromise.thenpackages/react-server/src/ReactFlightReplyServer.js
fulfillReferencepackages/react-server/src/ReactFlightReplyServer.js
getOutlinedModelpackages/react-server/src/ReactFlightReplyServer.js
loadServerReferencepackages/react-server/src/ReactFlightReplyServer.js
createModelpackages/react-server/src/ReactFlightReplyServer.js
parseTypedArraypackages/react-server/src/ReactFlightReplyServer.js
parseReadableStreampackages/react-server/src/ReactFlightReplyServer.js
parseAsyncIterablepackages/react-server/src/ReactFlightReplyServer.js
A Semantic Attack on Google Gemini - Read the Latest Research