{"record":{"id":"e683017292a2fa66","repo":"facebook/react","slug":"576","errorCode":"576","errorMessage":"Invalid Set initializer.","messagePattern":"Invalid Set initializer\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/react-server/src/ReactFlightReplyServer.js","lineNumber":1190,"sourceCode":"function createMap(\n  response: Response,\n  model: Array<[any, any]>,\n): Map<any, any> {\n  if (!isArray(model)) {\n    throw new Error('Invalid Map initializer.');\n  }\n  if ((model as any).$$consumed === true) {\n    throw new Error('Already initialized Map.');\n  }\n  // This needs to come first to prevent the model from being consumed again in case of a cyclic reference.\n  (model as any).$$consumed = true;\n  const map = new Map(model);\n  return map;\n}\n\nfunction createSet(response: Response, model: Array<any>): Set<any> {\n  if (!isArray(model)) {\n    throw new Error('Invalid Set initializer.');\n  }\n  if ((model as any).$$consumed === true) {\n    throw new Error('Already initialized Set.');\n  }\n  // This needs to come first to prevent the model from being consumed again in case of a cyclic reference.\n  (model as any).$$consumed = true;\n  const set = new Set(model);\n  return set;\n}\n\nfunction extractIterator(response: Response, model: Array<any>): Iterator<any> {\n  if (!isArray(model)) {\n    throw new Error('Invalid Iterator initializer.');\n  }\n  if ((model as any).$$consumed === true) {\n    throw new Error('Already initialized Iterator.');\n  }\n  // This needs to come first to prevent the model from being consumed again in case of a cyclic reference.","sourceCodeStart":1172,"sourceCodeEnd":1208,"githubUrl":"https://github.com/facebook/react/blob/eafeac097ba51e1eab809c07102126bd5f8e5425/packages/react-server/src/ReactFlightReplyServer.js#L1172-L1208","documentation":"A serialized Set is revived by createSet, which requires the decoded model to be an array of entries. If the chunk carrying the Set resolves to a non-array model, createSet throws before constructing the Set.","triggerScenarios":"The reply payload marks a chunk as a Set but its backing model parses to a non-array - corrupted or forged submissions, mutated multipart bodies, or encoder/decoder version mismatch.","commonSituations":"Crafted requests posted to action endpoints; proxies altering the body; stale client bundles from a different React release.","solutions":["Catch decode failures around the action dispatch and return 400.","Confirm both sides run the same React version.","Log malformed submissions; they are often probes rather than real user traffic."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const args = await decodeReply(formData);\n} catch (e) {\n  return new Response('Bad request', {status: 400});\n}","preventionTips":["Always wrap decodeReply/action dispatch in a catch that maps failures to 400.","Keep React versions in lockstep across client and server.","Log and alert on repeated malformed submissions."],"tags":["react","server-actions","deserialization","set"],"backgroundTag":"malformed-serialized-payload","analyzedSha":"eafeac097ba51e1eab809c07102126bd5f8e5425","analyzedAt":"2026-08-21T22:01:08.818Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}