High severity · published Apr 8, 2026
CVE-2026-23869
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and…
7.5
CVSS
1.6%
EPSS
No
On KEV
Description
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
react-server-dom-parcel · Meta
19.0.0 through 19.0.4; 19.1.0 through 19.1.5; 19.2.0 through 19.2.4 · source: vendor
RE
react-server-dom-turbopack · Meta
19.0.0 through 19.0.4; 19.1.0 through 19.1.5; 19.2.0 through 19.2.4 · source: vendor
RE
react-server-dom-webpack · Meta
19.0.0 through 19.0.4; 19.1.0 through 19.1.5; 19.2.0 through 19.2.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23869
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23869
github.com
https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-23869
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2456663
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23869.json
More from react-server-dom-parcel
10.0
CVE-2025-55182
Meta React Server Components Remote Code Execution Vulnerability
7.5
CVE-2026-44907
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the…
7.5
CVE-2026-23870
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory…
7.5
CVE-2026-23864
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack,…
7.5
CVE-2025-67779
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case