A Single POST Freezes Any Next.js Server
Simon Koeck
React Server Components’ server action request parsing can be forced to do multiple full scans of attacker-supplied form fields per nested-form pointer, blocking Node’s single-threaded request handling. One request with 10,000 pointers and 10,000 fields froze a production build for about 4 seconds and 3 requests in a row were enough for a load balancer to stop routing the server. React fixed it by scanning the field list once per request instead of once per pointer, with fixes released in React 19.0.6, 19.1.7, and 19.2.6 (GHSA-rv78-f8rc-xrxh; CVE-2026-23870).
Why it matters
A React Server Components flaw allows an attacker to force quadratic work while React rebuilds FormData for a server action, where a roughly 900 KB request can trigger ~100 million string checks and block the Node.js event loop. It affects vulnerable React 19.0 to 19.2 releases and is fixed in 19.0.6, 19.1.7, and 19.2.6.
