REDHAT-BUG-2456663: High severity npm/react-server-dom-parcel vulnerability
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2456663?
The severity of REDHAT-BUG-2456663 is high, rated at 7.
What is the risk associated with REDHAT-BUG-2456663?
The risk associated with REDHAT-BUG-2456663 includes a denial of service vulnerability.
How do I fix REDHAT-BUG-2456663?
To fix REDHAT-BUG-2456663, upgrade the affected packages to versions beyond 19.2.4.
Which packages are affected by REDHAT-BUG-2456663?
The affected packages are react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack.
What versions are vulnerable in REDHAT-BUG-2456663?
Versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4 are vulnerable in REDHAT-BUG-2456663.