CVE-2026-23864
React Server Components have multiple Denial of Service Vulnerabilities
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
- Record
CVE-2026-23864- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-502, CWE-400, CWE-1284
- Updated
- 2026-11-02
EUVDEUVD-2026-4673
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
- Record
EUVD-2026-4673- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-83fc-fqcc-2hmg
React Server Components have multiple Denial of Service Vulnerabilities
Impact
It was found that the fixes to address DoS in React Server Components were incomplete and we found multiple denial of service vulnerabilities still exist in React Server Components.
We recommend updating immediately.
The vulnerability exists in versions 19.0.0, 19.0.1, 19.0.2, 19.0.3, 19.1.0, 19.1.1, 19.1.2, 19.1.3, 19.1.4, 19.2.0, 19.2.1, 19.2.2, 19.2.3 of:
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Patches
Fixes were back ported to versions 19.0.4, 19.1.5, and 19.2.4.
If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
References
See the blog post for more information and upgrade instructions.
- Record
GHSA-83fc-fqcc-2hmg- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
NVD
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
- Record
CVE-2026-23864- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502, CWE-1284
- Updated
- 2026-11-02
OSV
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
- Record
CVE-2026-23864- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 22 moreShow less
OSVGHSA-83fc-fqcc-2hmg
React Server Components have multiple Denial of Service Vulnerabilities
Impact
It was found that the fixes to address DoS in React Server Components were incomplete and we found multiple denial of service vulnerabilities still exist in React Server Components.
We recommend updating immediately.
The vulnerability exists in versions 19.0.0, 19.0.1, 19.0.2, 19.0.3, 19.1.0, 19.1.1, 19.1.2, 19.1.3, 19.1.4, 19.2.0, 19.2.1, 19.2.2, 19.2.3 of:
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Patches
Fixes were back ported to versions 19.0.4, 19.1.5, and 19.2.4.
If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
References
See the blog post for more information and upgrade instructions.
- Record
GHSA-83fc-fqcc-2hmg- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
OSVCLSA-2026-1786388579 No score
TuxCare security update for react-server-dom-esm (4 CVEs)
TuxCare rebuilt react-server-dom-esm to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1786388579- Updated
- 2026-11-03
OSVCLSA-2026-1786531569 No score
TuxCare security update for 13 packages (9 CVEs)
TuxCare rebuilt 13 packages to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1786531569- Updated
- 2026-11-02
OSVCLSA-2026-1792161470 No score
TuxCare security update for react-art (4 CVEs)
TuxCare rebuilt react-art to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792161470- Updated
- 2026-11-02
OSVCLSA-2026-1792161493 No score
TuxCare security update for react-is (4 CVEs)
TuxCare rebuilt react-is to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792161493- Updated
- 2026-11-02
OSVCLSA-2026-1792161643 No score
TuxCare security update for react-server-dom-turbopack (4 CVEs)
TuxCare rebuilt react-server-dom-turbopack to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792161643- Updated
- 2026-11-02
OSVCLSA-2026-1792161658 No score
TuxCare security update for react-server-dom-webpack (4 CVEs)
TuxCare rebuilt react-server-dom-webpack to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792161658- Updated
- 2026-11-02
OSVCLSA-2026-1792195746 No score
TuxCare security update for create-next-app (9 CVEs)
TuxCare rebuilt create-next-app to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792195746- Updated
- 2026-11-02
OSVCLSA-2026-1792196727 No score
TuxCare security update for @next/eslint-plugin-next (9 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792196727- Updated
- 2026-11-02
OSVCLSA-2026-1792206302 No score
TuxCare security update for @next/bundle-analyzer (9 CVEs)
TuxCare rebuilt @next/bundle-analyzer to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792206302- Updated
- 2026-11-02
OSVCLSA-2026-1792251863 No score
TuxCare security update for react-server-dom-parcel (4 CVEs)
TuxCare rebuilt react-server-dom-parcel to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792251863- Updated
- 2026-11-02
OSVCLSA-2026-1792267917 No score
TuxCare security update for react-dom (4 CVEs)
TuxCare rebuilt react-dom to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792267917- Updated
- 2026-11-02
OSVCLSA-2026-1792272244 No score
TuxCare security update for @next/plugin-storybook (9 CVEs)
TuxCare rebuilt @next/plugin-storybook to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792272244- Updated
- 2026-11-02
OSVCLSA-2026-1792287260 No score
TuxCare security update for react-test-renderer (4 CVEs)
TuxCare rebuilt react-test-renderer to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792287260- Updated
- 2026-11-02
OSVCLSA-2026-1792293013 No score
TuxCare security update for @next/polyfill-module (9 CVEs)
TuxCare rebuilt @next/polyfill-module to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792293013- Updated
- 2026-11-02
OSVCLSA-2026-1792304739 No score
TuxCare security update for @next/polyfill-nomodule (9 CVEs)
TuxCare rebuilt @next/polyfill-nomodule to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792304739- Updated
- 2026-11-02
OSVCLSA-2026-1792326303 No score
TuxCare security update for @next/react-refresh-utils (9 CVEs)
TuxCare rebuilt @next/react-refresh-utils to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792326303- Updated
- 2026-11-02
OSVCLSA-2026-1792338233 No score
TuxCare security update for @next/third-parties (2 CVEs)
TuxCare rebuilt @next/third-parties to address 2 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792338233- Updated
- 2026-11-02
OSVCLSA-2026-1792358588 No score
TuxCare security update for @next/codemod (9 CVEs)
TuxCare rebuilt @next/codemod to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792358588- Updated
- 2026-11-02
OSVCLSA-2026-1792363988 No score
TuxCare security update for @next/mdx (9 CVEs)
TuxCare rebuilt @next/mdx to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792363988- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-h25m-26qc-wcjf No score
GHSA-h25m-26qc-wcjf in next - Patched by Root
Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-h25m-26qc-wcjf- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
react-server-dom-parcelnpm |
19.0.0 up to 19.0.4 | 19.0.4 |
react-server-dom-turbopacknpm |
19.1.0-canary-7130d0c6-20241212 up to 19.1.5 | 19.1.5 |
react-server-dom-webpacknpm |
19.2.0-canary-63779030-20250328 up to 19.2.4 | 19.2.4 |
react-server-dom-turbopacknpm |
19.0.0 up to 19.0.4 | 19.0.4 |
react-server-dom-parcelnpm |
19.1.0-canary-7130d0c6-20241212 up to 19.1.5 | 19.1.5 |
react-server-dom-parcelnpm |
19.2.0-canary-63779030-20250328 up to 19.2.4 | 19.2.4 |
react-server-dom-webpacknpm |
19.1.0-canary-7130d0c6-20241212 up to 19.1.5 | 19.1.5 |
react-server-dom-webpacknpm |
19.0.0 up to 19.0.4 | 19.0.4 |
react-server-dom-turbopacknpm |
19.2.0-canary-63779030-20250328 up to 19.2.4 | 19.2.4 |
nextnpm |
13.0.0 up to 15.0.8 | 15.0.8 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
15.1.1-canary.0 up to 15.1.12 | 15.1.12 |
nextnpm |
15.2.0-canary.0 up to 15.2.9 | 15.2.9 |
nextnpm |
15.3.0-canary.0 up to 15.3.9 | 15.3.9 |
nextnpm |
15.4.0-canary.0 up to 15.4.11 | 15.4.11 |
nextnpm |
15.5.1-canary.0 up to 15.5.10 | 15.5.10 |
nextnpm |
15.6.0-canary.0 up to 15.6.0-canary.61 | 15.6.0-canary.61 |
nextnpm |
16.0.0-beta.0 up to 16.0.11 | 16.0.11 |
nextnpm |
16.1.0-canary.0 up to 16.1.5 | 16.1.5 |
react-server-dom-esmTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.119.2.0-tuxcare.219.2.0-tuxcare.319.2.0-tuxcare.419.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-artTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-isTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-server-dom-turbopackTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-server-dom-webpackTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
create-next-appTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/eslint-plugin-nextTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/bundle-analyzerTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
react-server-dom-parcelTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-domTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.119.2.0-tuxcare.219.2.0-tuxcare.319.2.0-tuxcare.419.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
@next/plugin-storybookTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
react-test-rendererTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
@next/polyfill-moduleTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/polyfill-nomoduleTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/react-refresh-utilsTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/third-partiesTuxCare:npm From an advisory covering 2 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/codemodTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/mdxTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
nextRoot:npm |
before 14.2.5-aikido.5 | 14.2.5-aikido.514.2.5-aikido.814.2.33-aikido.214.2.32-aikido.414.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.2.15-aikido.414.0.4-aikido.914.1.3-aikido.214.2.24-aikido.214.2.25-aikido.214.2.18-aikido.213.3.0-aikido.514.2.15-aikido.314.0.4-aikido.514.0.4-aikido.714.0.4-aikido.214.1.0-aikido.714.1.0-aikido.814.0.4-aikido.314.2.13-aikido.114.2.32-aikido.114.2.3-aikido.514.2.0-aikido.214.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.29-aikido.514.2.31-aikido.214.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.1.4-aikido.514.2.25-aikido.113.2.4-aikido.314.2.0-aikido.614.0.4-aikido.414.2.31-aikido.514.2.0-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.113.2.4-aikido.414.0.3-aikido.614.2.32-aikido.514.2.33-aikido.314.0.0-aikido.514.2.5-aikido.314.2.3-aikido.314.2.2-aikido.513.5.11-aikido.714.2.2-aikido.614.2.30-aikido.113.5.4-aikido.514.2.30-aikido.214.1.3-aikido.614.2.5-aikido.413.3.0-aikido.614.2.30-aikido.314.0.3-aikido.414.2.13-aikido.214.2.5-aikido.614.2.21-aikido.414.0.0-aikido.314.1.4-aikido.714.2.21-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.35-aikido.514.2.30-aikido.413.2.4-aikido.513.3.0-aikido.714.2.33-aikido.414.2.26-aikido.314.0.3-aikido.514.2.30-aikido.914.1.4-aikido.814.2.35-aikido.314.2.32-aikido.614.2.35-aikido.613.5.4-aikido.614.1.3-aikido.714.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.5-aikido.714.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.214.2.28-aikido.514.2.32-aikido.214.1.4-aikido.914.2.32-aikido.713.5.6-aikido.514.2.15-aikido.614.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.28-aikido.114.2.35-aikido.214.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.514.2.28-aikido.214.2.26-aikido.214.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.1.4-aikido.614.2.35-aikido.714.2.18-aikido.314.1.0-aikido.514.2.16-aikido.314.0.0-aikido.414.2.18-aikido.413.5.4-aikido.314.2.0-aikido.313.4.19-aikido.514.0.0-aikido.214.2.31-aikido.414.2.29-aikido.213.5.4-aikido.414.2.21-aikido.114.2.16-aikido.114.1.3-aikido.313.3.0-aikido.813.1.6-aikido.214.2.21-aikido.313.2.4-aikido.614.2.32-aikido.314.2.29-aikido.313.5.11-aikido.914.1.3-aikido.414.2.0-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.614.2.35-aikido.814.2.35-aikido.414.2.35-aikido.114.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1115.5.10-aikido.415.5.10-aikido.515.5.10-aikido.615.5.10-aikido.3 |
@rootio/nextRoot:npm |
before 14.2.5-root.io.5 | 14.2.5-root.io.514.2.5-root.io.814.2.33-root.io.214.2.32-root.io.414.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.2.15-root.io.414.0.4-root.io.914.1.3-root.io.214.2.25-root.io.214.2.24-root.io.214.2.18-root.io.213.3.0-root.io.514.2.15-root.io.314.0.4-root.io.514.0.4-root.io.714.0.4-root.io.214.1.0-root.io.714.1.0-root.io.814.0.4-root.io.314.2.13-root.io.114.2.32-root.io.114.2.3-root.io.514.2.0-root.io.214.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.29-root.io.514.2.31-root.io.214.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.1.4-root.io.514.2.25-root.io.113.2.4-root.io.314.2.0-root.io.614.0.4-root.io.414.2.31-root.io.514.2.0-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.113.2.4-root.io.414.0.3-root.io.614.2.32-root.io.514.2.33-root.io.314.0.0-root.io.514.2.5-root.io.314.2.3-root.io.313.5.4-root.io.514.2.2-root.io.513.5.11-root.io.714.2.2-root.io.614.2.30-root.io.114.2.30-root.io.214.1.3-root.io.614.2.5-root.io.413.3.0-root.io.614.2.30-root.io.314.0.3-root.io.414.2.13-root.io.214.2.5-root.io.614.2.21-root.io.414.0.0-root.io.314.1.4-root.io.714.2.21-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.35-root.io.514.2.30-root.io.413.2.4-root.io.513.3.0-root.io.714.2.33-root.io.414.2.26-root.io.314.0.3-root.io.514.2.30-root.io.914.1.4-root.io.814.2.35-root.io.314.2.32-root.io.614.2.35-root.io.613.5.4-root.io.614.1.3-root.io.714.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.5-root.io.714.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.214.2.28-root.io.514.2.32-root.io.214.1.4-root.io.914.2.32-root.io.713.5.6-root.io.514.2.15-root.io.613.2.4-root.io.714.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.28-root.io.114.2.33-root.io.514.2.35-root.io.213.5.6-root.io.613.5.11-root.io.814.2.26-root.io.514.2.28-root.io.214.2.26-root.io.214.0.4-root.io.814.2.28-root.io.314.2.31-root.io.314.2.35-root.io.714.1.4-root.io.614.2.18-root.io.314.1.0-root.io.514.2.16-root.io.314.0.0-root.io.414.2.18-root.io.413.5.4-root.io.314.2.0-root.io.313.4.19-root.io.514.0.0-root.io.214.2.31-root.io.414.2.29-root.io.213.5.4-root.io.414.2.21-root.io.114.1.3-root.io.314.2.16-root.io.113.3.0-root.io.813.1.6-root.io.214.2.21-root.io.313.2.4-root.io.614.2.32-root.io.314.2.29-root.io.313.5.11-root.io.914.1.3-root.io.414.2.0-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.614.2.35-root.io.814.2.35-root.io.413.5.6-root.io.714.2.35-root.io.114.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1115.5.10-root.io.415.5.10-root.io.515.5.10-root.io.615.5.10-root.io.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-23864 is a high vulnerability (CVSS 7.5) in Facebook React, published January 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.58%, the 85th percentile. Fixed in react-server-dom-parcel 19.0.4.
References
facebook.com/security/advisories/cve-2026-23864
access.redhat.com/security/cve/CVE-2026-23864
bugzilla.redhat.com/show_bug.cgi?id=2433059
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23864.json
Show 9 moreShow less
github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg
nvd.nist.gov/vuln/detail/CVE-2026-23864
react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
vercel.com/changelog/summary-of-cve-2026-23864