This vulnerability in Meta's React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) allows an attacker to trigger excessive CPU usage by sending specially crafted HTTP requests to Server Function endpoints. The flaw relates to deserialization of untrusted data (CWE-502) combined with uncontrolled resource consumption (CWE-400), leading to a denial of service condition. Affected versions include 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4. The vulnerability causes the server to spend up to a minute processing the malicious payload before throwing a catchable error, impacting availability. The CVSS v3.1 base score is 7.5, reflecting network attack vector, no privileges required, no user interaction, and high impact on availability. No vendor advisory or patch information is currently available.

The vulnerability can cause denial of service by consuming excessive CPU resources on affected servers for up to a minute per attack attempt, potentially degrading service availability. There is no impact on confidentiality or integrity reported. The attack requires no privileges or user interaction and can be executed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing rate limiting or other controls on Server Function endpoints to mitigate potential denial of service. Monitor for unusual CPU usage patterns related to these endpoints. Do not assume the vulnerability is mitigated without official vendor confirmation.