CVE-2026-23869
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Meta | react-server-dom-turbopack | 19.0.0 <= 19.0.4 | affected |
| Meta | react-server-dom-turbopack | 19.1.0 <= 19.1.5 | affected |
| Meta | react-server-dom-turbopack | 19.2.0 <= 19.2.4 | affected |
| Meta | react-server-dom-parcel | 19.0.0 <= 19.0.4 | affected |
| Meta | react-server-dom-parcel | 19.1.0 <= 19.1.5 | affected |
| Meta | react-server-dom-parcel | 19.2.0 <= 19.2.4 | affected |
| Meta | react-server-dom-webpack | 19.0.0 <= 19.0.4 | affected |
| Meta | react-server-dom-webpack | 19.1.0 <= 19.1.5 | affected |
| Meta | react-server-dom-webpack | 19.2.0 <= 19.2.4 | affected |
Weaknesses
- (CWE-502) Deserialization of Untrusted Data, (CWE-400) Uncontrolled Resource Consumption
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: partial
react-server-dom-parcel: react-server-dom-turbopack: react-server-dom-webpack: denial of service via specially crafted HTTP requests to Server Function endpoints
Additional References
- https://access.redhat.com/security/cve/CVE-2026-23869
- https://bugzilla.redhat.com/show_bug.cgi?id=2456663
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23869.json
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.