React Server Components DoS vulnerability requires immediate upgrades

Summary

Any Next.js 13.3+ or RSC-based app (Router, Waku, Parcel, Vite, RedwoodSDK) can be taken offline by a single malicious request. This is not mitigated by upgrading for the prior RCE vulnerability; you need separate patched versions.

Why it matters

Any Next.js 13.3+ or RSC-based app (Router, Waku, Parcel, Vite, RedwoodSDK) can be taken offline by a single malicious request. This is not mitigated by upgrading for the prior RCE vulnerability; you need separate patched versions.

Sources

1. 1.allows an attacker to hang a server by sending a specifically crafted HTTP request that, when deserialized, causes an infinite loop
2. 2.All Next.js applications using App Router, on Next 13.3 or later, Next 14, Next 15, and Next 16
3. 3.If you have upgraded to the patched versions for that vulnerability, you are not protected against this new DoS vulnerability. You must upgrade again