7.5
High
CVE-2026-23864 Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages:…
Description
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code. Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| react-server-dom-webpack 19.2 | 19.2.0 → < 19.2.4 | 19.2.4 |
| react-server-dom-webpack 19.1 | 19.1.0 → < 19.1.5 | 19.1.5 |
| react-server-dom-webpack 19.0 | 19.0.0 → < 19.0.4 | 19.0.4 |
| react-server-dom-turbopack 19.2 | 19.2.0 → < 19.2.4 | 19.2.4 |
| react-server-dom-turbopack 19.1 | 19.1.0 → < 19.1.5 | 19.1.5 |
| react-server-dom-turbopack 19.0 | 19.0.0 → < 19.0.4 | 19.0.4 |
| react-server-dom-parcel 19.2 | 19.2.0 → < 19.2.4 | 19.2.4 |
| react-server-dom-parcel 19.1 | 19.1.0 → < 19.1.5 | 19.1.5 |
| react-server-dom-parcel 19.0 | 19.0.0 → < 19.0.4 | 19.0.4 |
Show the 3 other branches Hide the 3 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Streams for Apache Kafka 3.2.0 | Versions not published | |
| streams for Apache Kafka 2 | Versions not published | |
| Streams for Apache Kafka 2.9.4 | Versions not published |
References
- www.facebook.com www.facebook.com
Timeline
- Published
- Last modified
Other CVEs of react-server-dom-webpack
The 8 CVEs of react-server-dom-webpack →
CVE-2026-44907
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function…
7.5
High
CVE-2026-23870
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function…
7.5
High
CVE-2026-23869
A denial of service vulnerability exists in React Server Components, affecting the following packages:…
7.5
High
CVE-2025-67779
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a…
7.5
High