CVE-2026-23869
CVE-2026-23869
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
CVSS 7.5 · High · EPSS 1.6% · Public exploit · Fix available
- Published
- Updated
Stack: node
Affected products and versions
react-server-dom-turbopack
- Versions
- ≥ 19.0.0, ≤ 19.0.4: Affected (semver)
- ≥ 19.1.0, ≤ 19.1.5: Affected (semver)
- ≥ 19.2.0, ≤ 19.2.4: Affected (semver)
No fix published
react-server-dom-parcel
- Versions
- ≥ 19.0.0, ≤ 19.0.4: Affected (semver)
- ≥ 19.1.0, ≤ 19.1.5: Affected (semver)
- ≥ 19.2.0, ≤ 19.2.4: Affected (semver)
No fix published
react-server-dom-webpack
- Versions
- ≥ 19.0.0, ≤ 19.0.4: Affected (semver)
- ≥ 19.1.0, ≤ 19.1.5: Affected (semver)
- ≥ 19.2.0, ≤ 19.2.4: Affected (semver)
No fix published
react-server-dom-parcel npm
- Affected ranges
- SEMVER: ≥ 19.0.0, < 19.0.5
Update to 19.0.5
react-server-dom-parcel npm
- Affected ranges
- SEMVER: ≥ 19.1.0, < 19.1.6
Update to 19.1.6
react-server-dom-parcel npm
- Affected ranges
- SEMVER: ≥ 19.2.0, < 19.2.5
Update to 19.2.5
react-server-dom-turbopack npm
- Affected ranges
- SEMVER: ≥ 19.0.0, < 19.0.5
Update to 19.0.5
react-server-dom-turbopack npm
- Affected ranges
- SEMVER: ≥ 19.1.0, < 19.1.6
Update to 19.1.6
react-server-dom-turbopack npm
- Affected ranges
- SEMVER: ≥ 19.2.0, < 19.2.5
Update to 19.2.5
react-server-dom-webpack npm
- Affected ranges
- SEMVER: ≥ 19.0.0, < 19.0.5
Update to 19.0.5
react-server-dom-webpack npm
- Affected ranges
- SEMVER: ≥ 19.1.0, < 19.1.6
Update to 19.1.6
react-server-dom-webpack npm
- Affected ranges
- SEMVER: ≥ 19.2.0, < 19.2.5
Update to 19.2.5
Original sources
- https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg
- https://access.redhat.com/security/cve/CVE-2026-23869
- https://bugzilla.redhat.com/show_bug.cgi?id=2456663
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23869.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-23869