Sync React to c0d218f0 (Mar 24) — CVE-2026-23864

[hammadxcm]

Summary

Syncs vendored React packages from 8b2e903a (Mar 20) to c0d218f0 (Mar 24), updating all canary and experimental channel packages.

Closes #91890

CVE-2026-23864 / GHSA-83fc-fqcc-2hmg — Verification

The reported vulnerability (DoS in React Server Components via specially crafted HTTP requests to Server Function endpoints) was fixed in facebook/react#35632 ("[Flight] Add more DoS mitigations to Flight Reply, and harden Flight"), merged 2026-01-26.

The canary commit c0d218f0 (Mar 24) is 128 commits ahead of the fix commit 10680271, confirming the fix is fully included. In fact, both the old (8b2e903a, Mar 20) and new canaries already contain the fix — it was merged nearly two months prior. This sync updates to the very latest canary for completeness.

Protections present in the vendored React RSC server code:

Protection	Detail
Bound arguments limit	Server Functions limited to 1,000 bound arguments
Array size / nesting limit	Default 1,000,000 total slots across nested arrays (_arraySizeLimit)
BigInt size limit	Rejects BigInt values exceeding 300 digits
__proto__ pollution guards	Skips/deletes __proto__ keys during deserialization at multiple points
then key poisoning prevention	createModel() returns null for "then" function models
Plain object enforcement	Rejects non-plain objects (classes, null prototypes) in Server→Client serialization

Additional Next.js-level protections:

• HTTP body size limit: default 1 MB, configurable via serverActions.bodySizeLimit
• CSRF / origin validation with configurable allowedOrigins
• Action ID validation (42-char length check + serverModuleMap lookup)
• Header value length limiting for logs (100 chars)

Upstream React changes

diff facebook/react@8b2e903a...c0d218f0

• Fix useDeferredValue getting stuck facebook/react#36134 — Fix useDeferredValue getting stuck
• [DevTools] feat: display subtree for Activity and dim in hidden mode facebook/react#36094 — DevTools: display subtree for Activity

Packages updated

• react / react-dom / scheduler (canary + experimental)
• react-server-dom-webpack / react-server-dom-turbopack (canary + experimental)
• react-is

62 files changed across package.json, pnpm-lock.yaml, and packages/next/src/compiled/.

Test plan

• CI passes (build, lint, types, tests)
• No regressions in RSC e2e tests
• Verify vendored server-dom packages contain DoS mitigations (bound args limit, array size limit, BigInt limit, proto guards)

[nextjs-bot]

Allow CI Workflow Run

• approve CI run for commit: 72531d4

Note: this should only be enabled once the PR is ready to go and can only be enabled by a maintainer