This vulnerability involves deserialization of untrusted data (CWE-502) combined with uncontrolled resource consumption (CWE-400) in Meta's react-server-dom-turbopack and related packages. By sending specially crafted HTTP requests to server function endpoints, an attacker can cause denial of service conditions such as server crashes, out-of-memory exceptions, or excessive CPU usage. The affected versions include 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Successful exploitation results in denial of service by crashing the server, causing out-of-memory exceptions, or excessive CPU usage. There is no impact on confidentiality or integrity. The disruption affects availability of the server functions handling these requests.

No official fix or patch is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is released, consider implementing network-level protections such as rate limiting or filtering to reduce exposure to malicious crafted requests targeting server function endpoints.