Denial of Service Vulnerability in React Server Components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack)
Summary
GHSA-2m3v-v2m8-q956: Denial of Service Vulnerability in React Server Components. Affects react-server-dom-parcel across 3 version ranges.
>= 19.0.0, < 19.0.2
>= 19.1.0, < 19.1.3
>= 19.2.0, < 19.2.2
Fixed in 19.0.2, 19.1.3 or 19.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React Server Components are a feature of React that allow developers to build modern user interfaces by rendering components on the server. This approach enhances performance and user experience by reducing the amount of JavaScript sent to the client. However, certain versions of the packages 'react-server-dom-webpack', 'react-server-dom-parcel', and 'react-server-dom-turbopack' have been found to contain a denial of service vulnerability, which can lead to significant disruptions in service availability.
Vulnerability Detail
The denial of service vulnerability in React Server Components arises from specific flaws in the handling of requests within the affected packages. This vulnerability can be exploited by an attacker to overwhelm the server, causing it to become unresponsive. The affected versions include 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1. The potential ramifications include service downtime and degraded performance, which can significantly impact user experience and application reliability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 19.0.0, < 19.0.219.0.2npm install react-server-dom-parcel@19.0.2 -
>= 19.1.0, < 19.1.319.1.3npm install react-server-dom-parcel@19.1.3 -
>= 19.2.0, < 19.2.219.2.2npm install react-server-dom-parcel@19.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If your application does not utilize a server or does not employ a framework, bundler, or bundler plugin that supports React Server Components, it is not affected by this vulnerability. As a temporary measure, consider disabling the use of React Server Components until the packages are updated.
Conclusion
In summary, a denial of service vulnerability has been identified in specific versions of React Server Components. It is crucial for developers to update the affected packages promptly to mitigate potential service disruptions. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for react-server-dom-parcel →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert provides real-time alerts for vulnerabilities.
The affected versions include 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 of the packages 'react-server-dom-webpack', 'react-server-dom-parcel', and 'react-server-dom-turbopack'.
If immediate updates are not possible, consider disabling the use of React Server Components in your application until the packages can be updated.
For more information, you can refer to the official blog post on React's website detailing the vulnerability and upgrade instructions.
Related vulnerabilities
Recent vulnerabilities recorded for react-server-dom-parcel.
