React-Server-Dom-Turbopack
Unauthenticated remote code execution is possible in frameworks supporting React Server Components due to a desynchronization bug in React Flight serialization. The issue occurs when responses transport multiple typed arrays sharing an underlying buffer and an attacker-controlled value, specifically affecting configurations using Next.js Cache Components (`use cache`). An attacker can use a crafted HTTP GET request to exploit detached ArrayBuffer views and incorrect length framing, turning a deserialization over-read into a Server Action invocation. Applications that do not use a server or a framework, bundler, or plugin supporting React Server Components are not affected.