Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a Denial of Service in React Server Components, triggered by a specially crafted HTTP request. The root cause, identified from the fixing commit 44695455d4159078816623d119895f779cfe64ab, lies in the handling of potentially cyclic data structures during deserialization. The commit message "[Flight] Avoid consuming cyclic models multiple times" points directly to the issue.
The patch modifies three functions in packages/react-server/src/ReactFlightReplyServer.js: createMap, createSet, and extractIterator. In their vulnerable state, these functions would process an input model before marking it as consumed. If the model contained a cyclic reference, this could lead to an infinite loop or deep recursion, causing excessive CPU usage and a denial of service.
The fix is consistent across all three functions: a $$consumed flag is set on the model before it is passed to new Map(), new Set(), or Symbol.iterator(). This change prevents the processing of the same cyclic data structure multiple times. Therefore, createMap, createSet, and extractIterator are the specific vulnerable functions that would be active during the exploitation of this vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| react-server-dom-parcel | npm | >= 19.0.0, < 19.0.5 | 19.0.5 |
| react-server-dom-parcel | npm | >= 19.1.0, < 19.1.6 | 19.1.6 |
| react-server-dom-parcel | npm | >= 19.2.0, < 19.2.5 | 19.2.5 |
| react-server-dom-turbopack | npm | >= 19.0.0, < 19.0.5 | 19.0.5 |
| react-server-dom-turbopack | npm | >= 19.1.0, < 19.1.6 | 19.1.6 |
| react-server-dom-turbopack | npm | >= 19.2.0, < 19.2.5 | 19.2.5 |
| react-server-dom-webpack | npm | >= 19.0.0, < 19.0.5 | 19.0.5 |
| react-server-dom-webpack | npm | >= 19.1.0, < 19.1.6 | 19.1.6 |
| react-server-dom-webpack | npm | >= 19.2.0, < 19.2.5 | 19.2.5 |
