CVE-2026-23869
Published: Apr 8, 2026
Modified: Apr 8, 2026
CVSS v3.1
7.5
Description
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
| Vendor | Product | Versions |
|---|---|---|
Meta | react-server-dom-turbopack | affected 19.0.0 - <= 19.0.4affected 19.1.0 - <= 19.1.5affected 19.2.0 - <= 19.2.4 |
Meta | react-server-dom-parcel | affected 19.0.0 - <= 19.0.4affected 19.1.0 - <= 19.1.5affected 19.2.0 - <= 19.2.4 |
Meta | react-server-dom-webpack | affected 19.0.0 - <= 19.0.4affected 19.1.0 - <= 19.1.5affected 19.2.0 - <= 19.2.4 |
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now