CVE-2026-23870
Published: May 6, 2026
Modified: May 6, 2026
CVSS v3.1
7.5
Description
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
| Vendor | Product | Versions |
|---|---|---|
Meta | react-server-dom-turbopack | affected 19.0.0 - <= 19.0.5affected 19.1.0 - <= 19.1.6affected 19.2.0 - <= 19.2.5 |
Meta | react-server-dom-parcel | affected 19.0.0 - <= 19.0.5affected 19.1.0 - <= 19.1.6affected 19.2.0 - <= 19.2.5 |
Meta | react-server-dom-webpack | affected 19.0.0 - <= 19.0.5affected 19.1.0 - <= 19.1.6affected 19.2.0 - <= 19.2.5 |
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now