A SINGLE POST FREEZES ANY NEXT.JS SERVER

Summary from the TLDR Dev newsletter

A React Server Components flaw let an attacker force quadratic work while React rebuilt FormData for a server action, allowing a roughly 900 KB request to trigger 100 million string checks and block a Node.js event loop. The issue affects vulnerable React 19.0 to 19.2 releases and is fixed in 19.0.6, 19.1.7, and 19.2.6.