{"record":{"id":"10cee0fd703a664a","repo":"facebook/react","slug":"575","errorCode":"575","errorMessage":"Invalid Map initializer.","messagePattern":"Invalid Map initializer\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/react-server/src/ReactFlightReplyServer.js","lineNumber":1177,"sourceCode":"        initializingHandler = {\n          chunk: null,\n          value: null,\n          reason: chunk.reason,\n          deps: 0,\n          errored: true,\n        };\n      }\n      // Placeholder\n      return null as any;\n  }\n}\n\nfunction createMap(\n  response: Response,\n  model: Array<[any, any]>,\n): Map<any, any> {\n  if (!isArray(model)) {\n    throw new Error('Invalid Map initializer.');\n  }\n  if ((model as any).$$consumed === true) {\n    throw new Error('Already initialized Map.');\n  }\n  // This needs to come first to prevent the model from being consumed again in case of a cyclic reference.\n  (model as any).$$consumed = true;\n  const map = new Map(model);\n  return map;\n}\n\nfunction createSet(response: Response, model: Array<any>): Set<any> {\n  if (!isArray(model)) {\n    throw new Error('Invalid Set initializer.');\n  }\n  if ((model as any).$$consumed === true) {\n    throw new Error('Already initialized Set.');\n  }\n  // This needs to come first to prevent the model from being consumed again in case of a cyclic reference.","sourceCodeStart":1159,"sourceCodeEnd":1195,"githubUrl":"https://github.com/facebook/react/blob/eafeac097ba51e1eab809c07102126bd5f8e5425/packages/react-server/src/ReactFlightReplyServer.js#L1159-L1195","documentation":"A serialized Map is revived by createMap, which requires the decoded model to be an array of key/value pairs. If the chunk carrying the Map resolves to a non-array model, createMap throws before constructing the Map.","triggerScenarios":"The reply payload marks a chunk as a Map but its backing model parses to a non-array - corrupted submissions, mutated multipart bodies, or an encoder from a mismatched React version.","commonSituations":"Forged requests to an action endpoint; payload corruption through proxies; version skew between the client that serialized the Map and the server that revives it.","solutions":["Wrap action/decodeReply handling in a catch and return 400 for malformed payloads.","Verify client and server React versions match and redeploy together.","Treat all reply payloads as untrusted input; log and rate-limit repeated offenders."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const args = await decodeReply(formData);\n} catch (e) {\n  return new Response('Bad request', {status: 400});\n}","preventionTips":["Treat reply payloads as untrusted input and always guard decodeReply with a catch.","Keep client and server React versions aligned.","Rate-limit endpoints that accept form action submissions."],"tags":["react","server-actions","deserialization","map"],"backgroundTag":"malformed-serialized-payload","analyzedSha":"eafeac097ba51e1eab809c07102126bd5f8e5425","analyzedAt":"2026-08-21T22:01:08.818Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}