Adam on Mythryl: “A small request can stall the whole server; affected React and…”

A small request can stall the whole server; affected React and Next.js versions are explicit. https://simonkoeck.com/writeups/react-rsc-formdata-event-loop-dos

simonkoeck.comCVE-2026-23870: A Single POST Freezes Any Next.js Server | Simon KoeckTo rebuild one submitted form, React scanned every field in the request once for each reference it contained. Nothing capped either number, so one 900 KB POST makes the server do 100 million checks and freeze.

15/10/26, 3:46 pm0 reposts0 likes

Post