CVE-2026-23869
High · 7.5CVSS
7.5
EPSS
1.6%
Published
Apr 8, 2026
CISA due date
—
The record
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | react-server-dom-parcel | 19.0.0 | 19.0.5 |
| npm | react-server-dom-parcel | 19.1.0 | 19.1.6 |
| npm | react-server-dom-parcel | 19.2.0 | 19.2.5 |
| npm | react-server-dom-turbopack | 19.0.0 | 19.0.5 |
| npm | react-server-dom-turbopack | 19.1.0 | 19.1.6 |
| npm | react-server-dom-turbopack | 19.2.0 | 19.2.5 |
| npm | react-server-dom-webpack | 19.0.0 | 19.0.5 |
| npm | react-server-dom-webpack | 19.1.0 | 19.1.6 |
| npm | react-server-dom-webpack | 19.2.0 | 19.2.5 |
Related vulnerabilities
- GHSA-479c-33wc-g2pg React Server Components have a Denial of Service Vulnerability Same vulnerability
- GHSA-rv78-f8rc-xrxh Facebook React has a Denial of Service Vulnerability in React Server Components Also affects react-server-dom-parcel
- CVE-2026-23870 A denial of service vulnerability could be triggered by sending specially crafted HTTP… Also affects react-server-dom-parcel
- GHSA-83fc-fqcc-2hmg React Server Components have multiple Denial of Service Vulnerabilities Also affects react-server-dom-parcel
- CVE-2026-23864 Multiple denial of service vulnerabilities exist in React Server Components, affecting… Also affects react-server-dom-parcel
- GHSA-7gmr-mq3h-m5h9 Denial of Service Vulnerability in React Server Components Also affects react-server-dom-parcel
- CVE-2025-67779 Denial of Service Vulnerability in React Server Components Also affects react-server-dom-parcel
- GHSA-2m3v-v2m8-q956 Denial of Service Vulnerability in React Server Components Also affects react-server-dom-parcel