[PR #798] [MERGED] fix(app-router): reject cyclic Flight payloads in server actions #854

New issue

Closed

opened 2026-05-06 13:10:28 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:10:28 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/798
Author: @southpolesteve
Created: 4/9/2026
Status: ✅ Merged
Merged: 4/9/2026
Merged by: @southpolesteve

Base: main ← Head: fix/server-actions-dos-guard

📝 Commits (2)

1a06b02 fix(app-router): reject cyclic Flight payloads in server actions
4abb58e test(app-router): update generated entry snapshots

📊 Changes

12 files changed (+806 additions, -548 deletions)

View changed files

📝 README.md (+1 -1)
📝 packages/vinext/package.json (+4 -4)
📝 packages/vinext/src/cli.ts (+1 -1)
📝 packages/vinext/src/entries/app-rsc-entry.ts (+7 -1)
📝 packages/vinext/src/init.ts (+4 -4)
📝 packages/vinext/src/server/request-pipeline.ts (+85 -0)
📝 pnpm-lock.yaml (+501 -523)
📝 pnpm-workspace.yaml (+4 -4)
📝 tests/__snapshots__/entry-templates.test.ts.snap (+42 -6)
📝 tests/app-router.test.ts (+31 -0)
📝 tests/init.test.ts (+52 -4)
📝 tests/request-pipeline.test.ts (+74 -0)

📄 Description

Summary

bump the App Router dependency floor to react / react-dom / react-server-dom-webpack 19.2.5 and @vitejs/plugin-rsc 0.5.23, matching the upstream CVE-2026-23869 decoder updates
reject malformed cyclic Flight container-reference graphs before decodeReply, since vinext's App Router action path still reproduces the PoC without an early guard even after the upstream version bumps
add unit and integration coverage for the vendored decoder ordering, dependency floor, generated entry wiring, and cyclic multipart action payload rejection

Testing

vp test run tests/request-pipeline.test.ts
vp test run tests/init.test.ts
vp test run tests/app-router.test.ts -t "payload validation"
vp test run tests/app-router.test.ts -t "cyclic multipart server action payloads"

References

Vercel CVE summary: https://vercel.com/changelog/summary-of-cve-2026-23869
Next.js update: github.com/vercel/next.js@28739286a8
React decoder fix: https://github.com/facebook/react/pull/36236

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/798 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 4/9/2026 **Status:** ✅ Merged **Merged:** 4/9/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `fix/server-actions-dos-guard` --- ### 📝 Commits (2) - [`1a06b02`](https://github.com/cloudflare/vinext/commit/1a06b02deb58f177ccca616e3ce6ae6e61a6e0fe) fix(app-router): reject cyclic Flight payloads in server actions - [`4abb58e`](https://github.com/cloudflare/vinext/commit/4abb58e480a8455f22e7100c549425c1584726b0) test(app-router): update generated entry snapshots ### 📊 Changes **12 files changed** (+806 additions, -548 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+1 -1) 📝 `packages/vinext/package.json` (+4 -4) 📝 `packages/vinext/src/cli.ts` (+1 -1) 📝 `packages/vinext/src/entries/app-rsc-entry.ts` (+7 -1) 📝 `packages/vinext/src/init.ts` (+4 -4) 📝 `packages/vinext/src/server/request-pipeline.ts` (+85 -0) 📝 `pnpm-lock.yaml` (+501 -523) 📝 `pnpm-workspace.yaml` (+4 -4) 📝 `tests/__snapshots__/entry-templates.test.ts.snap` (+42 -6) 📝 `tests/app-router.test.ts` (+31 -0) 📝 `tests/init.test.ts` (+52 -4) 📝 `tests/request-pipeline.test.ts` (+74 -0) </details> ### 📄 Description ## Summary - bump the App Router dependency floor to `react` / `react-dom` / `react-server-dom-webpack` `19.2.5` and `@vitejs/plugin-rsc` `0.5.23`, matching the upstream CVE-2026-23869 decoder updates - reject malformed cyclic Flight container-reference graphs before `decodeReply`, since vinext's App Router action path still reproduces the PoC without an early guard even after the upstream version bumps - add unit and integration coverage for the vendored decoder ordering, dependency floor, generated entry wiring, and cyclic multipart action payload rejection ## Testing - `vp test run tests/request-pipeline.test.ts` - `vp test run tests/init.test.ts` - `vp test run tests/app-router.test.ts -t "payload validation"` - `vp test run tests/app-router.test.ts -t "cyclic multipart server action payloads"` ## References - Vercel CVE summary: https://vercel.com/changelog/summary-of-cve-2026-23869 - Next.js update: https://github.com/vercel/next.js/commit/28739286a88a83ab2d4e1899bdb4eb4ee7bee9a9 - React decoder fix: https://github.com/facebook/react/pull/36236 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>