7.5
Élevée
CVE-2026-23869 A denial of service vulnerability exists in React Server Components, affecting the following packages:…
Description
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| react-server-dom-turbopack 19.2 | 19.2.0 → 19.2.4 | Pas de correctif indiqué |
| react-server-dom-turbopack 19.1 | 19.1.0 → 19.1.5 | Pas de correctif indiqué |
| react-server-dom-turbopack 19.0 | 19.0.0 → 19.0.4 | Pas de correctif indiqué |
| react-server-dom-parcel 19.2 | 19.2.0 → 19.2.4 | Pas de correctif indiqué |
| react-server-dom-parcel 19.1 | 19.1.0 → 19.1.5 | Pas de correctif indiqué |
| react-server-dom-parcel 19.0 | 19.0.0 → 19.0.4 | Pas de correctif indiqué |
| react-server-dom-webpack 19.2 | 19.2.0 → 19.2.4 | Pas de correctif indiqué |
| react-server-dom-webpack 19.1 | 19.1.0 → 19.1.5 | Pas de correctif indiqué |
| react-server-dom-webpack 19.0 | 19.0.0 → 19.0.4 | Pas de correctif indiqué |
Afficher l’autre branche Masquer l’autre branche
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Versions non publiées |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de react-server-dom-turbopack
Les 8 CVE de react-server-dom-turbopack →
CVE-2026-44907
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function…
7.5
Élevée
CVE-2026-23870
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function…
7.5
Élevée
CVE-2026-23864
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages:…
7.5
Élevée
CVE-2025-67779
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a…
7.5
Élevée