Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling react-server-dom-turbopack is a React Server Components bindings for DOM using Turbopack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `decodeAction` and `decodeFormState` functions of `ReactFlightActionServer.js`, which perform action metadata decoding inside a loop over the submitted form fields. An attacker can drive quadratic CPU consumption and exhaust the server by submitting a Server Function request with many duplicate `$ACTION_REF_` or `$ACTION_ID_` form fields, each forcing a repeat of the expensive `decodeBoundActionMetaData()` processing. Exploitation affects only applications that expose React Server Functions through these server renderers and reaches the Flight reply decoder that handles Server Function submissions. Note: The project maintainers note that "[i]f your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability." How to fix Allocation of Resources Without Limits or Throttling? Upgrade `react-server-dom-turbopack` to version 19.0.8, 19.1.9, 19.2.8 or higher.	>=19.0.0 <19.0.8>=19.1.0-canary-029e8bd6-20250306 <19.1.9>=19.2.0-canary-0038c501-20250429 <19.2.8

Allocation of Resources Without Limits or Throttling

react-server-dom-turbopack is a React Server Components bindings for DOM using Turbopack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the decodeAction and decodeFormState functions of ReactFlightActionServer.js, which perform action metadata decoding inside a loop over the submitted form fields. An attacker can drive quadratic CPU consumption and exhaust the server by submitting a Server Function request with many duplicate $ACTION_REF_ or $ACTION_ID_ form fields, each forcing a repeat of the expensive decodeBoundActionMetaData() processing. Exploitation affects only applications that expose React Server Functions through these server renderers and reaches the Flight reply decoder that handles Server Function submissions.

Note: The project maintainers note that "[i]f your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability."

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade react-server-dom-turbopack to version 19.0.8, 19.1.9, 19.2.8 or higher.

>=19.0.0 <19.0.8>=19.1.0-canary-029e8bd6-20250306 <19.1.9>=19.2.0-canary-0038c501-20250429 <19.2.8

Go back to all versions of this package