This vulnerability involves unsafe deserialization (CWE-502) and uncontrolled resource consumption (CWE-400) in Meta's react-server-dom-turbopack and related packages. By sending specially crafted HTTP requests to server function endpoints, an attacker can cause denial of service conditions such as server crashes, out-of-memory exceptions, or excessive CPU usage. The issue affects multiple versions spanning 19.0.0 to 19.2.5 across react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability does not impact confidentiality or integrity but severely impacts availability.

Successful exploitation results in denial of service by crashing the server or exhausting system resources like memory and CPU. This disrupts availability of the affected server function endpoints. There is no indication of confidentiality or integrity compromise. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor Meta's advisories for updates. Until a patch is available, consider limiting exposure of server function endpoints to untrusted inputs or applying network-level protections to reduce risk.