DENIAL OF SERVICE AND SOURCE CODE EXPOSURE IN REACT SERVER COMPONENTS

Summary from the TLDR Dev newsletter

The React team has disclosed new high-severity Denial of Service (DoS) and medium-severity Source Code Exposure vulnerabilities in React Server Components. The DoS allows malicious requests to hang servers, while the exposure can leak hardcoded secrets from server functions, though neither enables Remote Code Execution. These issues are follow-ups to the recent React2Shell vulnerability. Previous patches (19.0.2, 19.1.3, and 19.2.2) were incomplete.