{"record":{"id":"ece45282bbfef434","repo":"facebook/react","slug":"577","errorCode":"577","errorMessage":"Invalid Iterator initializer.","messagePattern":"Invalid Iterator initializer\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/react-server/src/ReactFlightReplyServer.js","lineNumber":1203,"sourceCode":"  return map;\n}\n\nfunction createSet(response: Response, model: Array<any>): Set<any> {\n  if (!isArray(model)) {\n    throw new Error('Invalid Set initializer.');\n  }\n  if ((model as any).$$consumed === true) {\n    throw new Error('Already initialized Set.');\n  }\n  // This needs to come first to prevent the model from being consumed again in case of a cyclic reference.\n  (model as any).$$consumed = true;\n  const set = new Set(model);\n  return set;\n}\n\nfunction extractIterator(response: Response, model: Array<any>): Iterator<any> {\n  if (!isArray(model)) {\n    throw new Error('Invalid Iterator initializer.');\n  }\n  if ((model as any).$$consumed === true) {\n    throw new Error('Already initialized Iterator.');\n  }\n  // This needs to come first to prevent the model from being consumed again in case of a cyclic reference.\n  (model as any).$$consumed = true;\n  // $FlowFixMe[incompatible-use]: This uses raw Symbols because we're extracting from a native array.\n  const iterator = model[Symbol.iterator]();\n  return iterator;\n}\n\nfunction createModel(\n  response: Response,\n  model: any,\n  parentObject: Object,\n  key: string,\n): any {\n  if (key === 'then' && typeof model === 'function') {","sourceCodeStart":1185,"sourceCodeEnd":1221,"githubUrl":"https://github.com/facebook/react/blob/eafeac097ba51e1eab809c07102126bd5f8e5425/packages/react-server/src/ReactFlightReplyServer.js#L1185-L1221","documentation":"extractIterator revives a serialized iterator by calling Symbol.iterator on the decoded model, which must be an array. A non-array model (corrupted, forged, or version-skewed payload) fails the isArray check and throws.","triggerScenarios":"The reply marks a chunk as an iterator but its backing model parses to a non-array value - truncated multipart bodies, hand-crafted submissions, or a different React version's wire format.","commonSituations":"Malformed requests hitting an action endpoint; middleware corrupting the payload; clients and servers built from different React releases.","solutions":["Treat the decode failure as a bad request (catch and return 400).","Verify React version parity across the client/server boundary.","Rate-limit and log clients that repeatedly send malformed payloads."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const args = await decodeReply(formData);\n} catch (e) {\n  return new Response('Bad request', {status: 400});\n}","preventionTips":["Guard every decodeReply call site with a catch returning 400.","Keep React builds consistent on both sides of the boundary.","Cap submission size and validate content type before decoding."],"tags":["react","server-actions","deserialization","iterator"],"backgroundTag":"malformed-serialized-payload","analyzedSha":"eafeac097ba51e1eab809c07102126bd5f8e5425","analyzedAt":"2026-08-21T22:01:08.818Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}