r/netsec • u/TradeGold6317 • 6d ago

A Single POST Freezes Any Next.js Server

https://simonkoeck.com/writeups/react-rsc-formdata-event-loop-dos
137 Upvotes

99% Upvoted

7 comments sorted by

106

u/TradeGold6317 6d ago

Reported to Meta, fixed as CVE-2026-23870, no credit and no reply. So here's the writeup :)

49

u/0xcrypto 6d ago

Meta sucks. I have a full RCE chain on react native, works remotely on some condtions on many apps and can work on both iOS and android, yet meta just said it is not covered by their bug bounty program after months of wait. I think they have fixed it by now. I still have one of the report open, they never took time to close it I guess.

9

u/whomthefuckisthat 5d ago

Blog or pastebin pls

16

u/Consus26 6d ago

Great writeup! Not so great from metas site.

6

u/Azer_pubes33 4d ago

No credit and no reply on a CVE is rough, thanks for putting the writeup out anyway

7

u/elburrotelamete 6d ago

Por fin un post de calidad