CVEvulnerability

CVE-2026-23864

7.5 HIGH Published 2026-01-26 Modified 2026-07-15 Official page ↗
Status
Modified
Published
2026-01-26
Last modified
2026-07-15
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1284, CWE-400, CWE-502

Description

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code. Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.

Affected configurations

• facebook react (>= 19.0.0 < 19.0.4) • facebook react (>= 19.1.0 < 19.1.5) • facebook react (>= 19.2.0 < 19.2.4)

Related

Weakness · CWE (3)

  • CWE-1284 Improper Validation of Specified Quantity in Input weakness
  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References