CVE-2026-23869
React Server Components have a Denial of Service Vulnerability
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
- Record
CVE-2026-23869- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-502, CWE-400, CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-20584
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
- Record
EUVD-2026-20584- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-479c-33wc-g2pg
React Server Components have a Denial of Service Vulnerability
Impact
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack versions 19.0.0, 19.1.0 and 19.2.0. The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.
The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
We recommend updating immediately.
The vulnerability exists in versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4 of:
react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack
Patches
Fixes were back ported to versions 19.0.5, 19.1.6, and 19.2.5.
If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
References
See the blog post for more information and upgrade instructions.
- Record
GHSA-479c-33wc-g2pg- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
NVD
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
- Record
CVE-2026-23869- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502, CWE-770
- Updated
- 2026-11-02
OSV
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
- Record
CVE-2026-23869- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-479c-33wc-g2pg
React Server Components have a Denial of Service Vulnerability
Impact
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack versions 19.0.0, 19.1.0 and 19.2.0. The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.
The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
We recommend updating immediately.
The vulnerability exists in versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4 of:
react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack
Patches
Fixes were back ported to versions 19.0.5, 19.1.6, and 19.2.5.
If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
References
See the blog post for more information and upgrade instructions.
- Record
GHSA-479c-33wc-g2pg- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
Show 8 moreShow less
OSVCLSA-2026-1786388579 No score
TuxCare security update for react-server-dom-esm (4 CVEs)
TuxCare rebuilt react-server-dom-esm to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1786388579- Updated
- 2026-11-03
OSVCLSA-2026-1792161470 No score
TuxCare security update for react-art (4 CVEs)
TuxCare rebuilt react-art to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792161470- Updated
- 2026-11-02
OSVCLSA-2026-1792161493 No score
TuxCare security update for react-is (4 CVEs)
TuxCare rebuilt react-is to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792161493- Updated
- 2026-11-02
OSVCLSA-2026-1792161643 No score
TuxCare security update for react-server-dom-turbopack (4 CVEs)
TuxCare rebuilt react-server-dom-turbopack to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792161643- Updated
- 2026-11-02
OSVCLSA-2026-1792161658 No score
TuxCare security update for react-server-dom-webpack (4 CVEs)
TuxCare rebuilt react-server-dom-webpack to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792161658- Updated
- 2026-11-02
OSVCLSA-2026-1792251863 No score
TuxCare security update for react-server-dom-parcel (4 CVEs)
TuxCare rebuilt react-server-dom-parcel to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792251863- Updated
- 2026-11-02
OSVCLSA-2026-1792267917 No score
TuxCare security update for react-dom (4 CVEs)
TuxCare rebuilt react-dom to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792267917- Updated
- 2026-11-02
OSVCLSA-2026-1792287260 No score
TuxCare security update for react-test-renderer (4 CVEs)
TuxCare rebuilt react-test-renderer to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792287260- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
react-server-dom-parcelnpm |
19.0.0 up to 19.0.5 | 19.0.5 |
react-server-dom-parcelnpm |
19.1.0 up to 19.1.6 | 19.1.6 |
react-server-dom-parcelnpm |
19.2.0 up to 19.2.5 | 19.2.5 |
react-server-dom-turbopacknpm |
19.0.0 up to 19.0.5 | 19.0.5 |
react-server-dom-turbopacknpm |
19.1.0 up to 19.1.6 | 19.1.6 |
react-server-dom-turbopacknpm |
19.2.0 up to 19.2.5 | 19.2.5 |
react-server-dom-webpacknpm |
19.0.0 up to 19.0.5 | 19.0.5 |
react-server-dom-webpacknpm |
19.1.0 up to 19.1.6 | 19.1.6 |
react-server-dom-webpacknpm |
19.2.0 up to 19.2.5 | 19.2.5 |
react-server-dom-esmTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.119.2.0-tuxcare.219.2.0-tuxcare.319.2.0-tuxcare.419.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
react-artTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-isTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-server-dom-turbopackTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-server-dom-webpackTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-server-dom-parcelTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-domTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.119.2.0-tuxcare.219.2.0-tuxcare.319.2.0-tuxcare.419.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-test-rendererTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | yohannslm/CVE-2026-23869 | 2026-04-10 |
| PoC in GitHub | cybertechajju/CVE-2026-23869-Exploit | 2026-04-11 |
| PoC in GitHub | shaheryar773/mitigate-cve-2026-23869-react-server-component-loops | 2026-07-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, exploits | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-23869 is a high vulnerability (CVSS 7.5) in Meta React-server-dom-parcel, published April 8, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.57%, the 75th percentile. Fixed in react-server-dom-parcel 19.0.5.
References
github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg
access.redhat.com/security/cve/CVE-2026-23869
bugzilla.redhat.com/show_bug.cgi?id=2456663
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23869.json
nvd.nist.gov/vuln/detail/CVE-2026-23869
react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components