CVE-2026-23864
HighCVSS 7.5Exploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
Multiple denial of service vulnerabilities have been found in React Server Components packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack). Specially crafted HTTP requests to Server Function endpoints can cause server crashes, out-of-memory exceptions, or excessive CPU usage.
Risk Assessment
The risk involves potential disruption of application availability through remote server overload, leading to service outages and financial losses.
Recommendation
Immediately upgrade all affected packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) to the latest versions to mitigate the vulnerabilities.
Other vulnerabilities in React Server Components
See all- CVE-2025-55182CriticalActively exploited
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
- CVE-2026-23869High
A denial of service vulnerability in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) versions 19.0.0-19.0.4, 19.1.0-19.1.5, and 19.2.0-19.2.4. Specially crafted HTTP requests to Server Function endpoints cause excessive CPU usage for about a minute, ending in a catchable error.
Original NVD description (English source)
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code. Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.