[Flight] Add more DoS mitigations to Flight Reply, and harden Flight (#35632)

This fixes security vulnerabilities in Server Functions.
---------
Co-authored-by: Sebastian Markbåge <sebastian@calyptus.eu>
Co-authored-by: Josh Story <josh.c.story@gmail.com>
Co-authored-by: Janka Uryga <lolzatu2@gmail.com>
Co-authored-by: Sebastian Sebbie Silbermann <sebastian.silbermann@vercel.com>

Author: 5 people

packages/react-client/src/ReactFlightClient.js

@@ -94,6 +94,8 @@ import getComponentNameFromType from 'shared/getComponentNameFromType';
 
 import{getOwnerStackByComponentInfoInDev}from'shared/ReactComponentInfoStack';
 
+importhasOwnPropertyfrom'shared/hasOwnProperty';
+
 import{injectInternals}from'./ReactFlightClientDevToolsHook';
 
 import{OMITTED_PROP_ERROR}from'shared/ReactFlightPropertyAccess';
@@ -159,6 +161,8 @@ const INITIALIZED = 'fulfilled';
 constERRORED='rejected';
 constHALTED='halted';// DEV-only. Means it never resolves even if connection closes.
 
+const__PROTO__='__proto__';
+
 typePendingChunk<T>={
 status: 'pending',
 value: null|Array<InitializationReference|(T=>mixed)>,
@@ -1544,7 +1548,16 @@ function fulfillReference(
 }
 }
 }
-value=value[path[i]];
+constname=path[i];
+if(
+typeofvalue=== 'object' &&
+value!==null&&
+hasOwnProperty.call(value,name)
+){
+value=value[name];
+} else {
+thrownewError('Invalid reference.');
+}
 }
 
 while(
@@ -1580,7 +1593,9 @@ function fulfillReference(
 }
 
 constmappedValue=map(response,value,parentObject,key);
-parentObject[key]=mappedValue;
+if(key!==__PROTO__){
+parentObject[key]=mappedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -1849,7 +1864,9 @@ function loadServerReference<A: Iterable<any>, T>(
 response._encodeFormAction,
 );
 
-parentObject[key]=resolvedValue;
+if(key!==__PROTO__){
+parentObject[key]=resolvedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -2231,29 +2248,31 @@ function defineLazyGetter<T>(
 ): any {
 // We don't immediately initialize it even if it's resolved.
 // Instead, we wait for the getter to get accessed.
-Object.defineProperty(parentObject,key,{
-get: function(){
-if(chunk.status===RESOLVED_MODEL){
-// If it was now resolved, then we initialize it. This may then discover
-// a new set of lazy references that are then asked for eagerly in case
-// we get that deep.
-initializeModelChunk(chunk);
-}
-switch(chunk.status){
-caseINITIALIZED: {
-returnchunk.value;
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+if(chunk.status===RESOLVED_MODEL){
+// If it was now resolved, then we initialize it. This may then discover
+// a new set of lazy references that are then asked for eagerly in case
+// we get that deep.
+initializeModelChunk(chunk);
 }
-caseERRORED:
-throwchunk.reason;
-}
-// Otherwise, we didn't have enough time to load the object before it was
-// accessed or the connection closed. So we just log that it was omitted.
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+switch(chunk.status){
+caseINITIALIZED: {
+returnchunk.value;
+}
+caseERRORED:
+throwchunk.reason;
+}
+// Otherwise, we didn't have enough time to load the object before it was
+// accessed or the connection closed. So we just log that it was omitted.
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
  return null;
 }
 
@@ -2564,14 +2583,16 @@ function parseModelString(
 // In DEV mode we encode omitted objects in logs as a getter that throws
 // so that when you try to access it on the client, you know why that
 // happened.
-Object.defineProperty(parentObject,key,{
-get: function(){
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
 returnnull;
 }
 // Fallthrough
@@ -5183,6 +5204,9 @@ function parseModel<T>(response: Response, json: UninitializedModel): T {
 function createFromJSONCallback(response: Response) {
 // $FlowFixMe[missing-this-annot]
 returnfunction(key: string,value: JSONValue){
+if(key===__PROTO__){
+returnundefined;
+}
 if(typeofvalue==='string'){
 // We can't use .bind here because we need the "this" value.
 returnparseModelString(response,this,key,value);

packages/react-client/src/ReactFlightReplyClient.js

@@ -95,6 +95,8 @@ export type ReactServerValue =
 
 type ReactServerObject = {+[key: string]: ReactServerValue};
 
+const __PROTO__ = '__proto__';
+
 function serializeByValueID(id: number): string {
 return'$'+id.toString(16);
 }
@@ -361,6 +363,15 @@ export function processReply(
  ): ReactJSONValue {
 constparent=this;
 
+if(__DEV__){
+if(key===__PROTO__){
+console.error(
+'Expected not to serialize an object with own property `__proto__`. When parsed this property will be omitted.%s',
+describeObjectForErrorMessage(parent,key),
+);
+}
+}
+
 // Make sure that `parent[key]` wasn't JSONified before `value` was passed to us
 if(__DEV__){
 // $FlowFixMe[incompatible-use]
@@ -780,6 +791,10 @@ export function processReply(
  if (typeof value === 'function') {
 constreferenceClosure=knownServerReferences.get(value);
 if(referenceClosure!==undefined){
+const existingReference =writtenObjects.get(value);
+if(existingReference!==undefined){
+ return existingReference;
+}
 const{id, bound}=referenceClosure;
 constreferenceClosureJSON=JSON.stringify({id, bound},resolveToJSON);
 if(formData===null){
@@ -789,7 +804,10 @@ export function processReply(
 // The reference to this function came from the same client so we can pass it back.
 constrefId=nextPartId++;
 formData.set(formFieldPrefix+refId,referenceClosureJSON);
-returnserializeServerReferenceID(refId);
+constserverReferenceId=serializeServerReferenceID(refId);
+// Store the server reference ID for deduplication.
+writtenObjects.set(value,serverReferenceId);
+returnserverReferenceId;
 }
  if (temporaryReferences !== undefined &&key.indexOf(':')===-1){
 // TODO: If the property name contains a colon, we don't dedupe. Escape instead.

packages/react-client/src/forks/ReactFlightClientConfig.markup.js

@@ -43,7 +43,7 @@ export function resolveClientReference<T>(
 
 exportfunctionresolveServerReference<T>(
 config: ServerManifest,
-id: ServerReferenceId,
+id: mixed,
 ): ClientReference<T>{
 thrownewError(
 'renderToHTML should not have emitted Server References. This is a bug in React.',

packages/react-server-dom-esm/src/server/ReactFlightDOMServerNode.js

@@ -328,12 +328,17 @@ function prerenderToNodeStream(
 functiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 moduleBasePath,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -399,7 +404,10 @@ function decodeReplyFromBusboy<T>(
 functiondecodeReply<T>(
 body: string|FormData,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -411,6 +419,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerBrowser.js

@@ -245,7 +245,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -257,6 +260,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerEdge.js

@@ -250,7 +250,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -262,6 +265,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js

@@ -556,12 +556,17 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -626,7 +631,10 @@ export function decodeReplyFromBusboy<T>(
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -638,6 +646,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);
@@ -646,7 +655,10 @@ export function decodeReply<T>(
 
 exportfunctiondecodeReplyFromAsyncIterable<T>(
 iterable: AsyncIterable<[string,string|File]>,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 constiterator: AsyncIterator<[string,string|File]>=
 iterable[ASYNC_ITERATOR]();
@@ -655,6 +667,8 @@ export function decodeReplyFromAsyncIterable<T>(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 
 functionprogress(

packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerBrowser.js

@@ -239,7 +239,10 @@ function prerender(
 functiondecodeReply<T>(
 body: string|FormData,
 turbopackMap: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -251,6 +254,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-client/src/ReactFlightClient.js

@@ -94,6 +94,8 @@ import getComponentNameFromType from 'shared/getComponentNameFromType';
 
 import{getOwnerStackByComponentInfoInDev}from'shared/ReactComponentInfoStack';
 
+importhasOwnPropertyfrom'shared/hasOwnProperty';
+
 import{injectInternals}from'./ReactFlightClientDevToolsHook';
 
 import{OMITTED_PROP_ERROR}from'shared/ReactFlightPropertyAccess';
@@ -159,6 +161,8 @@ const INITIALIZED = 'fulfilled';
 constERRORED='rejected';
 constHALTED='halted';// DEV-only. Means it never resolves even if connection closes.
 
+const__PROTO__='__proto__';
+
 typePendingChunk<T>={
 status: 'pending',
 value: null|Array<InitializationReference|(T=>mixed)>,
@@ -1544,7 +1548,16 @@ function fulfillReference(
 }
 }
 }
-value=value[path[i]];
+constname=path[i];
+if(
+typeofvalue=== 'object' &&
+value!==null&&
+hasOwnProperty.call(value,name)
+){
+value=value[name];
+} else {
+thrownewError('Invalid reference.');
+}
 }
 
 while(
@@ -1580,7 +1593,9 @@ function fulfillReference(
 }
 
 constmappedValue=map(response,value,parentObject,key);
-parentObject[key]=mappedValue;
+if(key!==__PROTO__){
+parentObject[key]=mappedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -1849,7 +1864,9 @@ function loadServerReference<A: Iterable<any>, T>(
 response._encodeFormAction,
 );
 
-parentObject[key]=resolvedValue;
+if(key!==__PROTO__){
+parentObject[key]=resolvedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -2231,29 +2248,31 @@ function defineLazyGetter<T>(
 ): any {
 // We don't immediately initialize it even if it's resolved.
 // Instead, we wait for the getter to get accessed.
-Object.defineProperty(parentObject,key,{
-get: function(){
-if(chunk.status===RESOLVED_MODEL){
-// If it was now resolved, then we initialize it. This may then discover
-// a new set of lazy references that are then asked for eagerly in case
-// we get that deep.
-initializeModelChunk(chunk);
-}
-switch(chunk.status){
-caseINITIALIZED: {
-returnchunk.value;
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+if(chunk.status===RESOLVED_MODEL){
+// If it was now resolved, then we initialize it. This may then discover
+// a new set of lazy references that are then asked for eagerly in case
+// we get that deep.
+initializeModelChunk(chunk);
 }
-caseERRORED:
-throwchunk.reason;
-}
-// Otherwise, we didn't have enough time to load the object before it was
-// accessed or the connection closed. So we just log that it was omitted.
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+switch(chunk.status){
+caseINITIALIZED: {
+returnchunk.value;
+}
+caseERRORED:
+throwchunk.reason;
+}
+// Otherwise, we didn't have enough time to load the object before it was
+// accessed or the connection closed. So we just log that it was omitted.
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
  return null;
 }
 
@@ -2564,14 +2583,16 @@ function parseModelString(
 // In DEV mode we encode omitted objects in logs as a getter that throws
 // so that when you try to access it on the client, you know why that
 // happened.
-Object.defineProperty(parentObject,key,{
-get: function(){
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
 returnnull;
 }
 // Fallthrough
@@ -5183,6 +5204,9 @@ function parseModel<T>(response: Response, json: UninitializedModel): T {
 function createFromJSONCallback(response: Response) {
 // $FlowFixMe[missing-this-annot]
 returnfunction(key: string,value: JSONValue){
+if(key===__PROTO__){
+returnundefined;
+}
 if(typeofvalue==='string'){
 // We can't use .bind here because we need the "this" value.
 returnparseModelString(response,this,key,value);

packages/react-client/src/ReactFlightReplyClient.js

@@ -95,6 +95,8 @@ export type ReactServerValue =
 
 type ReactServerObject = {+[key: string]: ReactServerValue};
 
+const __PROTO__ = '__proto__';
+
 function serializeByValueID(id: number): string {
 return'$'+id.toString(16);
 }
@@ -361,6 +363,15 @@ export function processReply(
  ): ReactJSONValue {
 constparent=this;
 
+if(__DEV__){
+if(key===__PROTO__){
+console.error(
+'Expected not to serialize an object with own property `__proto__`. When parsed this property will be omitted.%s',
+describeObjectForErrorMessage(parent,key),
+);
+}
+}
+
 // Make sure that `parent[key]` wasn't JSONified before `value` was passed to us
 if(__DEV__){
 // $FlowFixMe[incompatible-use]
@@ -780,6 +791,10 @@ export function processReply(
  if (typeof value === 'function') {
 constreferenceClosure=knownServerReferences.get(value);
 if(referenceClosure!==undefined){
+const existingReference =writtenObjects.get(value);
+if(existingReference!==undefined){
+ return existingReference;
+}
 const{id, bound}=referenceClosure;
 constreferenceClosureJSON=JSON.stringify({id, bound},resolveToJSON);
 if(formData===null){
@@ -789,7 +804,10 @@ export function processReply(
 // The reference to this function came from the same client so we can pass it back.
 constrefId=nextPartId++;
 formData.set(formFieldPrefix+refId,referenceClosureJSON);
-returnserializeServerReferenceID(refId);
+constserverReferenceId=serializeServerReferenceID(refId);
+// Store the server reference ID for deduplication.
+writtenObjects.set(value,serverReferenceId);
+returnserverReferenceId;
 }
  if (temporaryReferences !== undefined &&key.indexOf(':')===-1){
 // TODO: If the property name contains a colon, we don't dedupe. Escape instead.

packages/react-client/src/forks/ReactFlightClientConfig.markup.js

@@ -43,7 +43,7 @@ export function resolveClientReference<T>(
 
 exportfunctionresolveServerReference<T>(
 config: ServerManifest,
-id: ServerReferenceId,
+id: mixed,
 ): ClientReference<T>{
 thrownewError(
 'renderToHTML should not have emitted Server References. This is a bug in React.',

packages/react-server-dom-esm/src/server/ReactFlightDOMServerNode.js

@@ -328,12 +328,17 @@ function prerenderToNodeStream(
 functiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 moduleBasePath,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -399,7 +404,10 @@ function decodeReplyFromBusboy<T>(
 functiondecodeReply<T>(
 body: string|FormData,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -411,6 +419,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerBrowser.js

@@ -245,7 +245,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -257,6 +260,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerEdge.js

@@ -250,7 +250,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -262,6 +265,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js

@@ -556,12 +556,17 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -626,7 +631,10 @@ export function decodeReplyFromBusboy<T>(
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -638,6 +646,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);
@@ -646,7 +655,10 @@ export function decodeReply<T>(
 
 exportfunctiondecodeReplyFromAsyncIterable<T>(
 iterable: AsyncIterable<[string,string|File]>,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 constiterator: AsyncIterator<[string,string|File]>=
 iterable[ASYNC_ITERATOR]();
@@ -655,6 +667,8 @@ export function decodeReplyFromAsyncIterable<T>(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 
 functionprogress(

packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerBrowser.js

@@ -239,7 +239,10 @@ function prerender(
 functiondecodeReply<T>(
 body: string|FormData,
 turbopackMap: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -251,6 +254,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-client/src/ReactFlightClient.js

@@ -94,6 +94,8 @@ import getComponentNameFromType from 'shared/getComponentNameFromType';
 
 import{getOwnerStackByComponentInfoInDev}from'shared/ReactComponentInfoStack';
 
+importhasOwnPropertyfrom'shared/hasOwnProperty';
+
 import{injectInternals}from'./ReactFlightClientDevToolsHook';
 
 import{OMITTED_PROP_ERROR}from'shared/ReactFlightPropertyAccess';
@@ -159,6 +161,8 @@ const INITIALIZED = 'fulfilled';
 constERRORED='rejected';
 constHALTED='halted';// DEV-only. Means it never resolves even if connection closes.
 
+const__PROTO__='__proto__';
+
 typePendingChunk<T>={
 status: 'pending',
 value: null|Array<InitializationReference|(T=>mixed)>,
@@ -1544,7 +1548,16 @@ function fulfillReference(
 }
 }
 }
-value=value[path[i]];
+constname=path[i];
+if(
+typeofvalue=== 'object' &&
+value!==null&&
+hasOwnProperty.call(value,name)
+){
+value=value[name];
+} else {
+thrownewError('Invalid reference.');
+}
 }
 
 while(
@@ -1580,7 +1593,9 @@ function fulfillReference(
 }
 
 constmappedValue=map(response,value,parentObject,key);
-parentObject[key]=mappedValue;
+if(key!==__PROTO__){
+parentObject[key]=mappedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -1849,7 +1864,9 @@ function loadServerReference<A: Iterable<any>, T>(
 response._encodeFormAction,
 );
 
-parentObject[key]=resolvedValue;
+if(key!==__PROTO__){
+parentObject[key]=resolvedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -2231,29 +2248,31 @@ function defineLazyGetter<T>(
 ): any {
 // We don't immediately initialize it even if it's resolved.
 // Instead, we wait for the getter to get accessed.
-Object.defineProperty(parentObject,key,{
-get: function(){
-if(chunk.status===RESOLVED_MODEL){
-// If it was now resolved, then we initialize it. This may then discover
-// a new set of lazy references that are then asked for eagerly in case
-// we get that deep.
-initializeModelChunk(chunk);
-}
-switch(chunk.status){
-caseINITIALIZED: {
-returnchunk.value;
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+if(chunk.status===RESOLVED_MODEL){
+// If it was now resolved, then we initialize it. This may then discover
+// a new set of lazy references that are then asked for eagerly in case
+// we get that deep.
+initializeModelChunk(chunk);
 }
-caseERRORED:
-throwchunk.reason;
-}
-// Otherwise, we didn't have enough time to load the object before it was
-// accessed or the connection closed. So we just log that it was omitted.
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+switch(chunk.status){
+caseINITIALIZED: {
+returnchunk.value;
+}
+caseERRORED:
+throwchunk.reason;
+}
+// Otherwise, we didn't have enough time to load the object before it was
+// accessed or the connection closed. So we just log that it was omitted.
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
  return null;
 }
 
@@ -2564,14 +2583,16 @@ function parseModelString(
 // In DEV mode we encode omitted objects in logs as a getter that throws
 // so that when you try to access it on the client, you know why that
 // happened.
-Object.defineProperty(parentObject,key,{
-get: function(){
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
 returnnull;
 }
 // Fallthrough
@@ -5183,6 +5204,9 @@ function parseModel<T>(response: Response, json: UninitializedModel): T {
 function createFromJSONCallback(response: Response) {
 // $FlowFixMe[missing-this-annot]
 returnfunction(key: string,value: JSONValue){
+if(key===__PROTO__){
+returnundefined;
+}
 if(typeofvalue==='string'){
 // We can't use .bind here because we need the "this" value.
 returnparseModelString(response,this,key,value);

packages/react-client/src/ReactFlightReplyClient.js

@@ -95,6 +95,8 @@ export type ReactServerValue =
 
 type ReactServerObject = {+[key: string]: ReactServerValue};
 
+const __PROTO__ = '__proto__';
+
 function serializeByValueID(id: number): string {
 return'$'+id.toString(16);
 }
@@ -361,6 +363,15 @@ export function processReply(
  ): ReactJSONValue {
 constparent=this;
 
+if(__DEV__){
+if(key===__PROTO__){
+console.error(
+'Expected not to serialize an object with own property `__proto__`. When parsed this property will be omitted.%s',
+describeObjectForErrorMessage(parent,key),
+);
+}
+}
+
 // Make sure that `parent[key]` wasn't JSONified before `value` was passed to us
 if(__DEV__){
 // $FlowFixMe[incompatible-use]
@@ -780,6 +791,10 @@ export function processReply(
  if (typeof value === 'function') {
 constreferenceClosure=knownServerReferences.get(value);
 if(referenceClosure!==undefined){
+const existingReference =writtenObjects.get(value);
+if(existingReference!==undefined){
+ return existingReference;
+}
 const{id, bound}=referenceClosure;
 constreferenceClosureJSON=JSON.stringify({id, bound},resolveToJSON);
 if(formData===null){
@@ -789,7 +804,10 @@ export function processReply(
 // The reference to this function came from the same client so we can pass it back.
 constrefId=nextPartId++;
 formData.set(formFieldPrefix+refId,referenceClosureJSON);
-returnserializeServerReferenceID(refId);
+constserverReferenceId=serializeServerReferenceID(refId);
+// Store the server reference ID for deduplication.
+writtenObjects.set(value,serverReferenceId);
+returnserverReferenceId;
 }
  if (temporaryReferences !== undefined &&key.indexOf(':')===-1){
 // TODO: If the property name contains a colon, we don't dedupe. Escape instead.

packages/react-client/src/forks/ReactFlightClientConfig.markup.js

@@ -43,7 +43,7 @@ export function resolveClientReference<T>(
 
 exportfunctionresolveServerReference<T>(
 config: ServerManifest,
-id: ServerReferenceId,
+id: mixed,
 ): ClientReference<T>{
 thrownewError(
 'renderToHTML should not have emitted Server References. This is a bug in React.',

packages/react-server-dom-esm/src/server/ReactFlightDOMServerNode.js

@@ -328,12 +328,17 @@ function prerenderToNodeStream(
 functiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 moduleBasePath,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -399,7 +404,10 @@ function decodeReplyFromBusboy<T>(
 functiondecodeReply<T>(
 body: string|FormData,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -411,6 +419,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerBrowser.js

@@ -245,7 +245,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -257,6 +260,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerEdge.js

@@ -250,7 +250,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -262,6 +265,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js

@@ -556,12 +556,17 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -626,7 +631,10 @@ export function decodeReplyFromBusboy<T>(
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -638,6 +646,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);
@@ -646,7 +655,10 @@ export function decodeReply<T>(
 
 exportfunctiondecodeReplyFromAsyncIterable<T>(
 iterable: AsyncIterable<[string,string|File]>,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 constiterator: AsyncIterator<[string,string|File]>=
 iterable[ASYNC_ITERATOR]();
@@ -655,6 +667,8 @@ export function decodeReplyFromAsyncIterable<T>(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 
 functionprogress(

packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerBrowser.js

@@ -239,7 +239,10 @@ function prerender(
 functiondecodeReply<T>(
 body: string|FormData,
 turbopackMap: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -251,6 +254,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-client/src/ReactFlightClient.js

@@ -94,6 +94,8 @@ import getComponentNameFromType from 'shared/getComponentNameFromType';
 
 import{getOwnerStackByComponentInfoInDev}from'shared/ReactComponentInfoStack';
 
+importhasOwnPropertyfrom'shared/hasOwnProperty';
+
 import{injectInternals}from'./ReactFlightClientDevToolsHook';
 
 import{OMITTED_PROP_ERROR}from'shared/ReactFlightPropertyAccess';
@@ -159,6 +161,8 @@ const INITIALIZED = 'fulfilled';
 constERRORED='rejected';
 constHALTED='halted';// DEV-only. Means it never resolves even if connection closes.
 
+const__PROTO__='__proto__';
+
 typePendingChunk<T>={
 status: 'pending',
 value: null|Array<InitializationReference|(T=>mixed)>,
@@ -1544,7 +1548,16 @@ function fulfillReference(
 }
 }
 }
-value=value[path[i]];
+constname=path[i];
+if(
+typeofvalue=== 'object' &&
+value!==null&&
+hasOwnProperty.call(value,name)
+){
+value=value[name];
+} else {
+thrownewError('Invalid reference.');
+}
 }
 
 while(
@@ -1580,7 +1593,9 @@ function fulfillReference(
 }
 
 constmappedValue=map(response,value,parentObject,key);
-parentObject[key]=mappedValue;
+if(key!==__PROTO__){
+parentObject[key]=mappedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -1849,7 +1864,9 @@ function loadServerReference<A: Iterable<any>, T>(
 response._encodeFormAction,
 );
 
-parentObject[key]=resolvedValue;
+if(key!==__PROTO__){
+parentObject[key]=resolvedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -2231,29 +2248,31 @@ function defineLazyGetter<T>(
 ): any {
 // We don't immediately initialize it even if it's resolved.
 // Instead, we wait for the getter to get accessed.
-Object.defineProperty(parentObject,key,{
-get: function(){
-if(chunk.status===RESOLVED_MODEL){
-// If it was now resolved, then we initialize it. This may then discover
-// a new set of lazy references that are then asked for eagerly in case
-// we get that deep.
-initializeModelChunk(chunk);
-}
-switch(chunk.status){
-caseINITIALIZED: {
-returnchunk.value;
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+if(chunk.status===RESOLVED_MODEL){
+// If it was now resolved, then we initialize it. This may then discover
+// a new set of lazy references that are then asked for eagerly in case
+// we get that deep.
+initializeModelChunk(chunk);
 }
-caseERRORED:
-throwchunk.reason;
-}
-// Otherwise, we didn't have enough time to load the object before it was
-// accessed or the connection closed. So we just log that it was omitted.
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+switch(chunk.status){
+caseINITIALIZED: {
+returnchunk.value;
+}
+caseERRORED:
+throwchunk.reason;
+}
+// Otherwise, we didn't have enough time to load the object before it was
+// accessed or the connection closed. So we just log that it was omitted.
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
  return null;
 }
 
@@ -2564,14 +2583,16 @@ function parseModelString(
 // In DEV mode we encode omitted objects in logs as a getter that throws
 // so that when you try to access it on the client, you know why that
 // happened.
-Object.defineProperty(parentObject,key,{
-get: function(){
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
 returnnull;
 }
 // Fallthrough
@@ -5183,6 +5204,9 @@ function parseModel<T>(response: Response, json: UninitializedModel): T {
 function createFromJSONCallback(response: Response) {
 // $FlowFixMe[missing-this-annot]
 returnfunction(key: string,value: JSONValue){
+if(key===__PROTO__){
+returnundefined;
+}
 if(typeofvalue==='string'){
 // We can't use .bind here because we need the "this" value.
 returnparseModelString(response,this,key,value);

packages/react-client/src/ReactFlightReplyClient.js

@@ -95,6 +95,8 @@ export type ReactServerValue =
 
 type ReactServerObject = {+[key: string]: ReactServerValue};
 
+const __PROTO__ = '__proto__';
+
 function serializeByValueID(id: number): string {
 return'$'+id.toString(16);
 }
@@ -361,6 +363,15 @@ export function processReply(
  ): ReactJSONValue {
 constparent=this;
 
+if(__DEV__){
+if(key===__PROTO__){
+console.error(
+'Expected not to serialize an object with own property `__proto__`. When parsed this property will be omitted.%s',
+describeObjectForErrorMessage(parent,key),
+);
+}
+}
+
 // Make sure that `parent[key]` wasn't JSONified before `value` was passed to us
 if(__DEV__){
 // $FlowFixMe[incompatible-use]
@@ -780,6 +791,10 @@ export function processReply(
  if (typeof value === 'function') {
 constreferenceClosure=knownServerReferences.get(value);
 if(referenceClosure!==undefined){
+const existingReference =writtenObjects.get(value);
+if(existingReference!==undefined){
+ return existingReference;
+}
 const{id, bound}=referenceClosure;
 constreferenceClosureJSON=JSON.stringify({id, bound},resolveToJSON);
 if(formData===null){
@@ -789,7 +804,10 @@ export function processReply(
 // The reference to this function came from the same client so we can pass it back.
 constrefId=nextPartId++;
 formData.set(formFieldPrefix+refId,referenceClosureJSON);
-returnserializeServerReferenceID(refId);
+constserverReferenceId=serializeServerReferenceID(refId);
+// Store the server reference ID for deduplication.
+writtenObjects.set(value,serverReferenceId);
+returnserverReferenceId;
 }
  if (temporaryReferences !== undefined &&key.indexOf(':')===-1){
 // TODO: If the property name contains a colon, we don't dedupe. Escape instead.

packages/react-client/src/forks/ReactFlightClientConfig.markup.js

@@ -43,7 +43,7 @@ export function resolveClientReference<T>(
 
 exportfunctionresolveServerReference<T>(
 config: ServerManifest,
-id: ServerReferenceId,
+id: mixed,
 ): ClientReference<T>{
 thrownewError(
 'renderToHTML should not have emitted Server References. This is a bug in React.',

packages/react-server-dom-esm/src/server/ReactFlightDOMServerNode.js

@@ -328,12 +328,17 @@ function prerenderToNodeStream(
 functiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 moduleBasePath,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -399,7 +404,10 @@ function decodeReplyFromBusboy<T>(
 functiondecodeReply<T>(
 body: string|FormData,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -411,6 +419,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerBrowser.js

@@ -245,7 +245,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -257,6 +260,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerEdge.js

@@ -250,7 +250,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -262,6 +265,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js

@@ -556,12 +556,17 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -626,7 +631,10 @@ export function decodeReplyFromBusboy<T>(
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -638,6 +646,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);
@@ -646,7 +655,10 @@ export function decodeReply<T>(
 
 exportfunctiondecodeReplyFromAsyncIterable<T>(
 iterable: AsyncIterable<[string,string|File]>,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 constiterator: AsyncIterator<[string,string|File]>=
 iterable[ASYNC_ITERATOR]();
@@ -655,6 +667,8 @@ export function decodeReplyFromAsyncIterable<T>(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 
 functionprogress(

packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerBrowser.js

@@ -239,7 +239,10 @@ function prerender(
 functiondecodeReply<T>(
 body: string|FormData,
 turbopackMap: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -251,6 +254,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-client/src/ReactFlightClient.js

@@ -94,6 +94,8 @@ import getComponentNameFromType from 'shared/getComponentNameFromType';
 
 import{getOwnerStackByComponentInfoInDev}from'shared/ReactComponentInfoStack';
 
+importhasOwnPropertyfrom'shared/hasOwnProperty';
+
 import{injectInternals}from'./ReactFlightClientDevToolsHook';
 
 import{OMITTED_PROP_ERROR}from'shared/ReactFlightPropertyAccess';
@@ -159,6 +161,8 @@ const INITIALIZED = 'fulfilled';
 constERRORED='rejected';
 constHALTED='halted';// DEV-only. Means it never resolves even if connection closes.
 
+const__PROTO__='__proto__';
+
 typePendingChunk<T>={
 status: 'pending',
 value: null|Array<InitializationReference|(T=>mixed)>,
@@ -1544,7 +1548,16 @@ function fulfillReference(
 }
 }
 }
-value=value[path[i]];
+constname=path[i];
+if(
+typeofvalue=== 'object' &&
+value!==null&&
+hasOwnProperty.call(value,name)
+){
+value=value[name];
+} else {
+thrownewError('Invalid reference.');
+}
 }
 
 while(
@@ -1580,7 +1593,9 @@ function fulfillReference(
 }
 
 constmappedValue=map(response,value,parentObject,key);
-parentObject[key]=mappedValue;
+if(key!==__PROTO__){
+parentObject[key]=mappedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -1849,7 +1864,9 @@ function loadServerReference<A: Iterable<any>, T>(
 response._encodeFormAction,
 );
 
-parentObject[key]=resolvedValue;
+if(key!==__PROTO__){
+parentObject[key]=resolvedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -2231,29 +2248,31 @@ function defineLazyGetter<T>(
 ): any {
 // We don't immediately initialize it even if it's resolved.
 // Instead, we wait for the getter to get accessed.
-Object.defineProperty(parentObject,key,{
-get: function(){
-if(chunk.status===RESOLVED_MODEL){
-// If it was now resolved, then we initialize it. This may then discover
-// a new set of lazy references that are then asked for eagerly in case
-// we get that deep.
-initializeModelChunk(chunk);
-}
-switch(chunk.status){
-caseINITIALIZED: {
-returnchunk.value;
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+if(chunk.status===RESOLVED_MODEL){
+// If it was now resolved, then we initialize it. This may then discover
+// a new set of lazy references that are then asked for eagerly in case
+// we get that deep.
+initializeModelChunk(chunk);
 }
-caseERRORED:
-throwchunk.reason;
-}
-// Otherwise, we didn't have enough time to load the object before it was
-// accessed or the connection closed. So we just log that it was omitted.
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+switch(chunk.status){
+caseINITIALIZED: {
+returnchunk.value;
+}
+caseERRORED:
+throwchunk.reason;
+}
+// Otherwise, we didn't have enough time to load the object before it was
+// accessed or the connection closed. So we just log that it was omitted.
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
  return null;
 }
 
@@ -2564,14 +2583,16 @@ function parseModelString(
 // In DEV mode we encode omitted objects in logs as a getter that throws
 // so that when you try to access it on the client, you know why that
 // happened.
-Object.defineProperty(parentObject,key,{
-get: function(){
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
 returnnull;
 }
 // Fallthrough
@@ -5183,6 +5204,9 @@ function parseModel<T>(response: Response, json: UninitializedModel): T {
 function createFromJSONCallback(response: Response) {
 // $FlowFixMe[missing-this-annot]
 returnfunction(key: string,value: JSONValue){
+if(key===__PROTO__){
+returnundefined;
+}
 if(typeofvalue==='string'){
 // We can't use .bind here because we need the "this" value.
 returnparseModelString(response,this,key,value);

packages/react-client/src/ReactFlightReplyClient.js

@@ -95,6 +95,8 @@ export type ReactServerValue =
 
 type ReactServerObject = {+[key: string]: ReactServerValue};
 
+const __PROTO__ = '__proto__';
+
 function serializeByValueID(id: number): string {
 return'$'+id.toString(16);
 }
@@ -361,6 +363,15 @@ export function processReply(
  ): ReactJSONValue {
 constparent=this;
 
+if(__DEV__){
+if(key===__PROTO__){
+console.error(
+'Expected not to serialize an object with own property `__proto__`. When parsed this property will be omitted.%s',
+describeObjectForErrorMessage(parent,key),
+);
+}
+}
+
 // Make sure that `parent[key]` wasn't JSONified before `value` was passed to us
 if(__DEV__){
 // $FlowFixMe[incompatible-use]
@@ -780,6 +791,10 @@ export function processReply(
  if (typeof value === 'function') {
 constreferenceClosure=knownServerReferences.get(value);
 if(referenceClosure!==undefined){
+const existingReference =writtenObjects.get(value);
+if(existingReference!==undefined){
+ return existingReference;
+}
 const{id, bound}=referenceClosure;
 constreferenceClosureJSON=JSON.stringify({id, bound},resolveToJSON);
 if(formData===null){
@@ -789,7 +804,10 @@ export function processReply(
 // The reference to this function came from the same client so we can pass it back.
 constrefId=nextPartId++;
 formData.set(formFieldPrefix+refId,referenceClosureJSON);
-returnserializeServerReferenceID(refId);
+constserverReferenceId=serializeServerReferenceID(refId);
+// Store the server reference ID for deduplication.
+writtenObjects.set(value,serverReferenceId);
+returnserverReferenceId;
 }
  if (temporaryReferences !== undefined &&key.indexOf(':')===-1){
 // TODO: If the property name contains a colon, we don't dedupe. Escape instead.

packages/react-client/src/forks/ReactFlightClientConfig.markup.js

@@ -43,7 +43,7 @@ export function resolveClientReference<T>(
 
 exportfunctionresolveServerReference<T>(
 config: ServerManifest,
-id: ServerReferenceId,
+id: mixed,
 ): ClientReference<T>{
 thrownewError(
 'renderToHTML should not have emitted Server References. This is a bug in React.',

packages/react-server-dom-esm/src/server/ReactFlightDOMServerNode.js

@@ -328,12 +328,17 @@ function prerenderToNodeStream(
 functiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 moduleBasePath,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -399,7 +404,10 @@ function decodeReplyFromBusboy<T>(
 functiondecodeReply<T>(
 body: string|FormData,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -411,6 +419,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerBrowser.js

@@ -245,7 +245,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -257,6 +260,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerEdge.js

@@ -250,7 +250,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -262,6 +265,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js

@@ -556,12 +556,17 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -626,7 +631,10 @@ export function decodeReplyFromBusboy<T>(
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -638,6 +646,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);
@@ -646,7 +655,10 @@ export function decodeReply<T>(
 
 exportfunctiondecodeReplyFromAsyncIterable<T>(
 iterable: AsyncIterable<[string,string|File]>,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 constiterator: AsyncIterator<[string,string|File]>=
 iterable[ASYNC_ITERATOR]();
@@ -655,6 +667,8 @@ export function decodeReplyFromAsyncIterable<T>(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 
 functionprogress(

packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerBrowser.js

@@ -239,7 +239,10 @@ function prerender(
 functiondecodeReply<T>(
 body: string|FormData,
 turbopackMap: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -251,6 +254,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-client/src/ReactFlightClient.js

@@ -94,6 +94,8 @@ import getComponentNameFromType from 'shared/getComponentNameFromType';
 
 import{getOwnerStackByComponentInfoInDev}from'shared/ReactComponentInfoStack';
 
+importhasOwnPropertyfrom'shared/hasOwnProperty';
+
 import{injectInternals}from'./ReactFlightClientDevToolsHook';
 
 import{OMITTED_PROP_ERROR}from'shared/ReactFlightPropertyAccess';
@@ -159,6 +161,8 @@ const INITIALIZED = 'fulfilled';
 constERRORED='rejected';
 constHALTED='halted';// DEV-only. Means it never resolves even if connection closes.
 
+const__PROTO__='__proto__';
+
 typePendingChunk<T>={
 status: 'pending',
 value: null|Array<InitializationReference|(T=>mixed)>,
@@ -1544,7 +1548,16 @@ function fulfillReference(
 }
 }
 }
-value=value[path[i]];
+constname=path[i];
+if(
+typeofvalue=== 'object' &&
+value!==null&&
+hasOwnProperty.call(value,name)
+){
+value=value[name];
+} else {
+thrownewError('Invalid reference.');
+}
 }
 
 while(
@@ -1580,7 +1593,9 @@ function fulfillReference(
 }
 
 constmappedValue=map(response,value,parentObject,key);
-parentObject[key]=mappedValue;
+if(key!==__PROTO__){
+parentObject[key]=mappedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -1849,7 +1864,9 @@ function loadServerReference<A: Iterable<any>, T>(
 response._encodeFormAction,
 );
 
-parentObject[key]=resolvedValue;
+if(key!==__PROTO__){
+parentObject[key]=resolvedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -2231,29 +2248,31 @@ function defineLazyGetter<T>(
 ): any {
 // We don't immediately initialize it even if it's resolved.
 // Instead, we wait for the getter to get accessed.
-Object.defineProperty(parentObject,key,{
-get: function(){
-if(chunk.status===RESOLVED_MODEL){
-// If it was now resolved, then we initialize it. This may then discover
-// a new set of lazy references that are then asked for eagerly in case
-// we get that deep.
-initializeModelChunk(chunk);
-}
-switch(chunk.status){
-caseINITIALIZED: {
-returnchunk.value;
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+if(chunk.status===RESOLVED_MODEL){
+// If it was now resolved, then we initialize it. This may then discover
+// a new set of lazy references that are then asked for eagerly in case
+// we get that deep.
+initializeModelChunk(chunk);
 }
-caseERRORED:
-throwchunk.reason;
-}
-// Otherwise, we didn't have enough time to load the object before it was
-// accessed or the connection closed. So we just log that it was omitted.
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+switch(chunk.status){
+caseINITIALIZED: {
+returnchunk.value;
+}
+caseERRORED:
+throwchunk.reason;
+}
+// Otherwise, we didn't have enough time to load the object before it was
+// accessed or the connection closed. So we just log that it was omitted.
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
  return null;
 }
 
@@ -2564,14 +2583,16 @@ function parseModelString(
 // In DEV mode we encode omitted objects in logs as a getter that throws
 // so that when you try to access it on the client, you know why that
 // happened.
-Object.defineProperty(parentObject,key,{
-get: function(){
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
 returnnull;
 }
 // Fallthrough
@@ -5183,6 +5204,9 @@ function parseModel<T>(response: Response, json: UninitializedModel): T {
 function createFromJSONCallback(response: Response) {
 // $FlowFixMe[missing-this-annot]
 returnfunction(key: string,value: JSONValue){
+if(key===__PROTO__){
+returnundefined;
+}
 if(typeofvalue==='string'){
 // We can't use .bind here because we need the "this" value.
 returnparseModelString(response,this,key,value);

packages/react-client/src/ReactFlightReplyClient.js

@@ -95,6 +95,8 @@ export type ReactServerValue =
 
 type ReactServerObject = {+[key: string]: ReactServerValue};
 
+const __PROTO__ = '__proto__';
+
 function serializeByValueID(id: number): string {
 return'$'+id.toString(16);
 }
@@ -361,6 +363,15 @@ export function processReply(
  ): ReactJSONValue {
 constparent=this;
 
+if(__DEV__){
+if(key===__PROTO__){
+console.error(
+'Expected not to serialize an object with own property `__proto__`. When parsed this property will be omitted.%s',
+describeObjectForErrorMessage(parent,key),
+);
+}
+}
+
 // Make sure that `parent[key]` wasn't JSONified before `value` was passed to us
 if(__DEV__){
 // $FlowFixMe[incompatible-use]
@@ -780,6 +791,10 @@ export function processReply(
  if (typeof value === 'function') {
 constreferenceClosure=knownServerReferences.get(value);
 if(referenceClosure!==undefined){
+const existingReference =writtenObjects.get(value);
+if(existingReference!==undefined){
+ return existingReference;
+}
 const{id, bound}=referenceClosure;
 constreferenceClosureJSON=JSON.stringify({id, bound},resolveToJSON);
 if(formData===null){
@@ -789,7 +804,10 @@ export function processReply(
 // The reference to this function came from the same client so we can pass it back.
 constrefId=nextPartId++;
 formData.set(formFieldPrefix+refId,referenceClosureJSON);
-returnserializeServerReferenceID(refId);
+constserverReferenceId=serializeServerReferenceID(refId);
+// Store the server reference ID for deduplication.
+writtenObjects.set(value,serverReferenceId);
+returnserverReferenceId;
 }
  if (temporaryReferences !== undefined &&key.indexOf(':')===-1){
 // TODO: If the property name contains a colon, we don't dedupe. Escape instead.

packages/react-client/src/forks/ReactFlightClientConfig.markup.js

@@ -43,7 +43,7 @@ export function resolveClientReference<T>(
 
 exportfunctionresolveServerReference<T>(
 config: ServerManifest,
-id: ServerReferenceId,
+id: mixed,
 ): ClientReference<T>{
 thrownewError(
 'renderToHTML should not have emitted Server References. This is a bug in React.',

packages/react-server-dom-esm/src/server/ReactFlightDOMServerNode.js

@@ -328,12 +328,17 @@ function prerenderToNodeStream(
 functiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 moduleBasePath,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -399,7 +404,10 @@ function decodeReplyFromBusboy<T>(
 functiondecodeReply<T>(
 body: string|FormData,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -411,6 +419,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerBrowser.js

@@ -245,7 +245,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -257,6 +260,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerEdge.js

@@ -250,7 +250,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -262,6 +265,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js

@@ -556,12 +556,17 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -626,7 +631,10 @@ export function decodeReplyFromBusboy<T>(
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -638,6 +646,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);
@@ -646,7 +655,10 @@ export function decodeReply<T>(
 
 exportfunctiondecodeReplyFromAsyncIterable<T>(
 iterable: AsyncIterable<[string,string|File]>,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 constiterator: AsyncIterator<[string,string|File]>=
 iterable[ASYNC_ITERATOR]();
@@ -655,6 +667,8 @@ export function decodeReplyFromAsyncIterable<T>(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 
 functionprogress(

packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerBrowser.js

@@ -239,7 +239,10 @@ function prerender(
 functiondecodeReply<T>(
 body: string|FormData,
 turbopackMap: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -251,6 +254,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-client/src/ReactFlightClient.js

@@ -94,6 +94,8 @@ import getComponentNameFromType from 'shared/getComponentNameFromType';
 
 import{getOwnerStackByComponentInfoInDev}from'shared/ReactComponentInfoStack';
 
+importhasOwnPropertyfrom'shared/hasOwnProperty';
+
 import{injectInternals}from'./ReactFlightClientDevToolsHook';
 
 import{OMITTED_PROP_ERROR}from'shared/ReactFlightPropertyAccess';
@@ -159,6 +161,8 @@ const INITIALIZED = 'fulfilled';
 constERRORED='rejected';
 constHALTED='halted';// DEV-only. Means it never resolves even if connection closes.
 
+const__PROTO__='__proto__';
+
 typePendingChunk<T>={
 status: 'pending',
 value: null|Array<InitializationReference|(T=>mixed)>,
@@ -1544,7 +1548,16 @@ function fulfillReference(
 }
 }
 }
-value=value[path[i]];
+constname=path[i];
+if(
+typeofvalue=== 'object' &&
+value!==null&&
+hasOwnProperty.call(value,name)
+){
+value=value[name];
+} else {
+thrownewError('Invalid reference.');
+}
 }
 
 while(
@@ -1580,7 +1593,9 @@ function fulfillReference(
 }
 
 constmappedValue=map(response,value,parentObject,key);
-parentObject[key]=mappedValue;
+if(key!==__PROTO__){
+parentObject[key]=mappedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -1849,7 +1864,9 @@ function loadServerReference<A: Iterable<any>, T>(
 response._encodeFormAction,
 );
 
-parentObject[key]=resolvedValue;
+if(key!==__PROTO__){
+parentObject[key]=resolvedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -2231,29 +2248,31 @@ function defineLazyGetter<T>(
 ): any {
 // We don't immediately initialize it even if it's resolved.
 // Instead, we wait for the getter to get accessed.
-Object.defineProperty(parentObject,key,{
-get: function(){
-if(chunk.status===RESOLVED_MODEL){
-// If it was now resolved, then we initialize it. This may then discover
-// a new set of lazy references that are then asked for eagerly in case
-// we get that deep.
-initializeModelChunk(chunk);
-}
-switch(chunk.status){
-caseINITIALIZED: {
-returnchunk.value;
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+if(chunk.status===RESOLVED_MODEL){
+// If it was now resolved, then we initialize it. This may then discover
+// a new set of lazy references that are then asked for eagerly in case
+// we get that deep.
+initializeModelChunk(chunk);
 }
-caseERRORED:
-throwchunk.reason;
-}
-// Otherwise, we didn't have enough time to load the object before it was
-// accessed or the connection closed. So we just log that it was omitted.
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+switch(chunk.status){
+caseINITIALIZED: {
+returnchunk.value;
+}
+caseERRORED:
+throwchunk.reason;
+}
+// Otherwise, we didn't have enough time to load the object before it was
+// accessed or the connection closed. So we just log that it was omitted.
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
  return null;
 }
 
@@ -2564,14 +2583,16 @@ function parseModelString(
 // In DEV mode we encode omitted objects in logs as a getter that throws
 // so that when you try to access it on the client, you know why that
 // happened.
-Object.defineProperty(parentObject,key,{
-get: function(){
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
 returnnull;
 }
 // Fallthrough
@@ -5183,6 +5204,9 @@ function parseModel<T>(response: Response, json: UninitializedModel): T {
 function createFromJSONCallback(response: Response) {
 // $FlowFixMe[missing-this-annot]
 returnfunction(key: string,value: JSONValue){
+if(key===__PROTO__){
+returnundefined;
+}
 if(typeofvalue==='string'){
 // We can't use .bind here because we need the "this" value.
 returnparseModelString(response,this,key,value);

packages/react-client/src/ReactFlightReplyClient.js

@@ -95,6 +95,8 @@ export type ReactServerValue =
 
 type ReactServerObject = {+[key: string]: ReactServerValue};
 
+const __PROTO__ = '__proto__';
+
 function serializeByValueID(id: number): string {
 return'$'+id.toString(16);
 }
@@ -361,6 +363,15 @@ export function processReply(
  ): ReactJSONValue {
 constparent=this;
 
+if(__DEV__){
+if(key===__PROTO__){
+console.error(
+'Expected not to serialize an object with own property `__proto__`. When parsed this property will be omitted.%s',
+describeObjectForErrorMessage(parent,key),
+);
+}
+}
+
 // Make sure that `parent[key]` wasn't JSONified before `value` was passed to us
 if(__DEV__){
 // $FlowFixMe[incompatible-use]
@@ -780,6 +791,10 @@ export function processReply(
  if (typeof value === 'function') {
 constreferenceClosure=knownServerReferences.get(value);
 if(referenceClosure!==undefined){
+const existingReference =writtenObjects.get(value);
+if(existingReference!==undefined){
+ return existingReference;
+}
 const{id, bound}=referenceClosure;
 constreferenceClosureJSON=JSON.stringify({id, bound},resolveToJSON);
 if(formData===null){
@@ -789,7 +804,10 @@ export function processReply(
 // The reference to this function came from the same client so we can pass it back.
 constrefId=nextPartId++;
 formData.set(formFieldPrefix+refId,referenceClosureJSON);
-returnserializeServerReferenceID(refId);
+constserverReferenceId=serializeServerReferenceID(refId);
+// Store the server reference ID for deduplication.
+writtenObjects.set(value,serverReferenceId);
+returnserverReferenceId;
 }
  if (temporaryReferences !== undefined &&key.indexOf(':')===-1){
 // TODO: If the property name contains a colon, we don't dedupe. Escape instead.

packages/react-client/src/forks/ReactFlightClientConfig.markup.js

@@ -43,7 +43,7 @@ export function resolveClientReference<T>(
 
 exportfunctionresolveServerReference<T>(
 config: ServerManifest,
-id: ServerReferenceId,
+id: mixed,
 ): ClientReference<T>{
 thrownewError(
 'renderToHTML should not have emitted Server References. This is a bug in React.',

packages/react-server-dom-esm/src/server/ReactFlightDOMServerNode.js

@@ -328,12 +328,17 @@ function prerenderToNodeStream(
 functiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 moduleBasePath,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -399,7 +404,10 @@ function decodeReplyFromBusboy<T>(
 functiondecodeReply<T>(
 body: string|FormData,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -411,6 +419,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerBrowser.js

@@ -245,7 +245,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -257,6 +260,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerEdge.js

@@ -250,7 +250,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -262,6 +265,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js

@@ -556,12 +556,17 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -626,7 +631,10 @@ export function decodeReplyFromBusboy<T>(
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -638,6 +646,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);
@@ -646,7 +655,10 @@ export function decodeReply<T>(
 
 exportfunctiondecodeReplyFromAsyncIterable<T>(
 iterable: AsyncIterable<[string,string|File]>,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 constiterator: AsyncIterator<[string,string|File]>=
 iterable[ASYNC_ITERATOR]();
@@ -655,6 +667,8 @@ export function decodeReplyFromAsyncIterable<T>(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 
 functionprogress(

packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerBrowser.js

@@ -239,7 +239,10 @@ function prerender(
 functiondecodeReply<T>(
 body: string|FormData,
 turbopackMap: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -251,6 +254,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-client/src/ReactFlightClient.js

@@ -94,6 +94,8 @@ import getComponentNameFromType from 'shared/getComponentNameFromType';
 
 import{getOwnerStackByComponentInfoInDev}from'shared/ReactComponentInfoStack';
 
+importhasOwnPropertyfrom'shared/hasOwnProperty';
+
 import{injectInternals}from'./ReactFlightClientDevToolsHook';
 
 import{OMITTED_PROP_ERROR}from'shared/ReactFlightPropertyAccess';
@@ -159,6 +161,8 @@ const INITIALIZED = 'fulfilled';
 constERRORED='rejected';
 constHALTED='halted';// DEV-only. Means it never resolves even if connection closes.
 
+const__PROTO__='__proto__';
+
 typePendingChunk<T>={
 status: 'pending',
 value: null|Array<InitializationReference|(T=>mixed)>,
@@ -1544,7 +1548,16 @@ function fulfillReference(
 }
 }
 }
-value=value[path[i]];
+constname=path[i];
+if(
+typeofvalue=== 'object' &&
+value!==null&&
+hasOwnProperty.call(value,name)
+){
+value=value[name];
+} else {
+thrownewError('Invalid reference.');
+}
 }
 
 while(
@@ -1580,7 +1593,9 @@ function fulfillReference(
 }
 
 constmappedValue=map(response,value,parentObject,key);
-parentObject[key]=mappedValue;
+if(key!==__PROTO__){
+parentObject[key]=mappedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -1849,7 +1864,9 @@ function loadServerReference<A: Iterable<any>, T>(
 response._encodeFormAction,
 );
 
-parentObject[key]=resolvedValue;
+if(key!==__PROTO__){
+parentObject[key]=resolvedValue;
+}
 
  // If this is the root object for a model reference, where `handler.value`
  // is a stale `null`, the resolved value can be used directly.
@@ -2231,29 +2248,31 @@ function defineLazyGetter<T>(
 ): any {
 // We don't immediately initialize it even if it's resolved.
 // Instead, we wait for the getter to get accessed.
-Object.defineProperty(parentObject,key,{
-get: function(){
-if(chunk.status===RESOLVED_MODEL){
-// If it was now resolved, then we initialize it. This may then discover
-// a new set of lazy references that are then asked for eagerly in case
-// we get that deep.
-initializeModelChunk(chunk);
-}
-switch(chunk.status){
-caseINITIALIZED: {
-returnchunk.value;
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+if(chunk.status===RESOLVED_MODEL){
+// If it was now resolved, then we initialize it. This may then discover
+// a new set of lazy references that are then asked for eagerly in case
+// we get that deep.
+initializeModelChunk(chunk);
 }
-caseERRORED:
-throwchunk.reason;
-}
-// Otherwise, we didn't have enough time to load the object before it was
-// accessed or the connection closed. So we just log that it was omitted.
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+switch(chunk.status){
+caseINITIALIZED: {
+returnchunk.value;
+}
+caseERRORED:
+throwchunk.reason;
+}
+// Otherwise, we didn't have enough time to load the object before it was
+// accessed or the connection closed. So we just log that it was omitted.
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
  return null;
 }
 
@@ -2564,14 +2583,16 @@ function parseModelString(
 // In DEV mode we encode omitted objects in logs as a getter that throws
 // so that when you try to access it on the client, you know why that
 // happened.
-Object.defineProperty(parentObject,key,{
-get: function(){
-// TODO: We should ideally throw here to indicate a difference.
-returnOMITTED_PROP_ERROR;
-},
-enumerable: true,
-configurable: false,
-});
+if(key!==__PROTO__){
+Object.defineProperty(parentObject,key,{
+get: function(){
+// TODO: We should ideally throw here to indicate a difference.
+returnOMITTED_PROP_ERROR;
+},
+enumerable: true,
+configurable: false,
+});
+}
 returnnull;
 }
 // Fallthrough
@@ -5183,6 +5204,9 @@ function parseModel<T>(response: Response, json: UninitializedModel): T {
 function createFromJSONCallback(response: Response) {
 // $FlowFixMe[missing-this-annot]
 returnfunction(key: string,value: JSONValue){
+if(key===__PROTO__){
+returnundefined;
+}
 if(typeofvalue==='string'){
 // We can't use .bind here because we need the "this" value.
 returnparseModelString(response,this,key,value);

packages/react-client/src/ReactFlightReplyClient.js

@@ -95,6 +95,8 @@ export type ReactServerValue =
 
 type ReactServerObject = {+[key: string]: ReactServerValue};
 
+const __PROTO__ = '__proto__';
+
 function serializeByValueID(id: number): string {
 return'$'+id.toString(16);
 }
@@ -361,6 +363,15 @@ export function processReply(
  ): ReactJSONValue {
 constparent=this;
 
+if(__DEV__){
+if(key===__PROTO__){
+console.error(
+'Expected not to serialize an object with own property `__proto__`. When parsed this property will be omitted.%s',
+describeObjectForErrorMessage(parent,key),
+);
+}
+}
+
 // Make sure that `parent[key]` wasn't JSONified before `value` was passed to us
 if(__DEV__){
 // $FlowFixMe[incompatible-use]
@@ -780,6 +791,10 @@ export function processReply(
  if (typeof value === 'function') {
 constreferenceClosure=knownServerReferences.get(value);
 if(referenceClosure!==undefined){
+const existingReference =writtenObjects.get(value);
+if(existingReference!==undefined){
+ return existingReference;
+}
 const{id, bound}=referenceClosure;
 constreferenceClosureJSON=JSON.stringify({id, bound},resolveToJSON);
 if(formData===null){
@@ -789,7 +804,10 @@ export function processReply(
 // The reference to this function came from the same client so we can pass it back.
 constrefId=nextPartId++;
 formData.set(formFieldPrefix+refId,referenceClosureJSON);
-returnserializeServerReferenceID(refId);
+constserverReferenceId=serializeServerReferenceID(refId);
+// Store the server reference ID for deduplication.
+writtenObjects.set(value,serverReferenceId);
+returnserverReferenceId;
 }
  if (temporaryReferences !== undefined &&key.indexOf(':')===-1){
 // TODO: If the property name contains a colon, we don't dedupe. Escape instead.

packages/react-client/src/forks/ReactFlightClientConfig.markup.js

@@ -43,7 +43,7 @@ export function resolveClientReference<T>(
 
 exportfunctionresolveServerReference<T>(
 config: ServerManifest,
-id: ServerReferenceId,
+id: mixed,
 ): ClientReference<T>{
 thrownewError(
 'renderToHTML should not have emitted Server References. This is a bug in React.',

packages/react-server-dom-esm/src/server/ReactFlightDOMServerNode.js

@@ -328,12 +328,17 @@ function prerenderToNodeStream(
 functiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 moduleBasePath,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -399,7 +404,10 @@ function decodeReplyFromBusboy<T>(
 functiondecodeReply<T>(
 body: string|FormData,
 moduleBasePath: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -411,6 +419,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerBrowser.js

@@ -245,7 +245,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -257,6 +260,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerEdge.js

@@ -250,7 +250,10 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -262,6 +265,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);

packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js

@@ -556,12 +556,17 @@ export function registerServerActions(manifest: ServerManifest) {
 
 exportfunctiondecodeReplyFromBusboy<T>(
 busboyStream: Busboy,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 const response =createResponse(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 letpendingFiles=0;
 constqueuedFields: Array<string>=[];
@@ -626,7 +631,10 @@ export function decodeReplyFromBusboy<T>(
 
 exportfunctiondecodeReply<T>(
 body: string|FormData,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody=== 'string'){
 constform=newFormData();
@@ -638,6 +646,7 @@ export function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);
@@ -646,7 +655,10 @@ export function decodeReply<T>(
 
 exportfunctiondecodeReplyFromAsyncIterable<T>(
 iterable: AsyncIterable<[string,string|File]>,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 constiterator: AsyncIterator<[string,string|File]>=
 iterable[ASYNC_ITERATOR]();
@@ -655,6 +667,8 @@ export function decodeReplyFromAsyncIterable<T>(
 serverManifest,
 '',
 options ? options.temporaryReferences : undefined,
+undefined,
+options ? options.arraySizeLimit : undefined,
 );
 
 functionprogress(

packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerBrowser.js

@@ -239,7 +239,10 @@ function prerender(
 functiondecodeReply<T>(
 body: string|FormData,
 turbopackMap: ServerManifest,
-options?: {temporaryReferences?: TemporaryReferenceSet},
+options?: {
+temporaryReferences?: TemporaryReferenceSet,
+arraySizeLimit?: number,
+},
 ): Thenable<T>{
 if(typeofbody==='string'){
 constform=newFormData();
@@ -251,6 +254,7 @@ function decodeReply<T>(
 '',
 options ? options.temporaryReferences : undefined,
 body,
+options ? options.arraySizeLimit : undefined,
 );
 constroot=getRoot<T>(response);
 close(response);