7.5
High
CVE-2026-23869 A denial of service vulnerability exists in React Server Components, affecting the following packages:…
Description
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| react-server-dom-turbopack 19.2 | 19.2.0 → 19.2.4 | No fix stated |
| react-server-dom-turbopack 19.1 | 19.1.0 → 19.1.5 | No fix stated |
| react-server-dom-turbopack 19.0 | 19.0.0 → 19.0.4 | No fix stated |
| react-server-dom-parcel 19.2 | 19.2.0 → 19.2.4 | No fix stated |
| react-server-dom-parcel 19.1 | 19.1.0 → 19.1.5 | No fix stated |
| react-server-dom-parcel 19.0 | 19.0.0 → 19.0.4 | No fix stated |
| react-server-dom-webpack 19.2 | 19.2.0 → 19.2.4 | No fix stated |
| react-server-dom-webpack 19.1 | 19.1.0 → 19.1.5 | No fix stated |
| react-server-dom-webpack 19.0 | 19.0.0 → 19.0.4 | No fix stated |
Show the other branch Hide the other branch
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Versions not published |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of react-server-dom-turbopack
The 8 CVEs of react-server-dom-turbopack →
CVE-2026-44907
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function…
7.5
High
CVE-2026-23870
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function…
7.5
High
CVE-2026-23864
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages:…
7.5
High
CVE-2025-67779
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a…
7.5
High