CVE-2026-23870
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
- Record
CVE-2026-23870- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
EUVDEUVD-2026-27867
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
- Record
EUVD-2026-27867- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rv78-f8rc-xrxh
Facebook React has a Denial of Service Vulnerability in React Server Components
Impact
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.
We recommend updating immediately.
The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of:
react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack
Patches
Fixes were back ported to versions 19.0.6, 19.1.7, and 19.2.6.
If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
References See the blog post for more information and upgrade instructions.
- Record
GHSA-rv78-f8rc-xrxh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
NVD
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
- Record
CVE-2026-23870- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
- Record
CVE-2026-23870- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 22 moreShow less
OSVGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
OSVGHSA-rv78-f8rc-xrxh
Facebook React has a Denial of Service Vulnerability in React Server Components
Impact
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.
We recommend updating immediately.
The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of:
react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack
Patches
Fixes were back ported to versions 19.0.6, 19.1.7, and 19.2.6.
If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
References See the blog post for more information and upgrade instructions.
- Record
GHSA-rv78-f8rc-xrxh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSVCLSA-2026-1786388579 No score
TuxCare security update for react-server-dom-esm (4 CVEs)
TuxCare rebuilt react-server-dom-esm to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1786388579- Updated
- 2026-11-03
OSVCLSA-2026-1786531569 No score
TuxCare security update for 13 packages (9 CVEs)
TuxCare rebuilt 13 packages to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1786531569- Updated
- 2026-11-02
OSVCLSA-2026-1792161470 No score
TuxCare security update for react-art (4 CVEs)
TuxCare rebuilt react-art to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792161470- Updated
- 2026-11-02
OSVCLSA-2026-1792161493 No score
TuxCare security update for react-is (4 CVEs)
TuxCare rebuilt react-is to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792161493- Updated
- 2026-11-02
OSVCLSA-2026-1792161643 No score
TuxCare security update for react-server-dom-turbopack (4 CVEs)
TuxCare rebuilt react-server-dom-turbopack to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792161643- Updated
- 2026-11-02
OSVCLSA-2026-1792161658 No score
TuxCare security update for react-server-dom-webpack (4 CVEs)
TuxCare rebuilt react-server-dom-webpack to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792161658- Updated
- 2026-11-02
OSVCLSA-2026-1792195746 No score
TuxCare security update for create-next-app (9 CVEs)
TuxCare rebuilt create-next-app to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792195746- Updated
- 2026-11-02
OSVCLSA-2026-1792196727 No score
TuxCare security update for @next/eslint-plugin-next (9 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792196727- Updated
- 2026-11-02
OSVCLSA-2026-1792206302 No score
TuxCare security update for @next/bundle-analyzer (9 CVEs)
TuxCare rebuilt @next/bundle-analyzer to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792206302- Updated
- 2026-11-02
OSVCLSA-2026-1792251863 No score
TuxCare security update for react-server-dom-parcel (4 CVEs)
TuxCare rebuilt react-server-dom-parcel to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792251863- Updated
- 2026-11-02
OSVCLSA-2026-1792267917 No score
TuxCare security update for react-dom (4 CVEs)
TuxCare rebuilt react-dom to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792267917- Updated
- 2026-11-02
OSVCLSA-2026-1792272244 No score
TuxCare security update for @next/plugin-storybook (9 CVEs)
TuxCare rebuilt @next/plugin-storybook to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792272244- Updated
- 2026-11-02
OSVCLSA-2026-1792287260 No score
TuxCare security update for react-test-renderer (4 CVEs)
TuxCare rebuilt react-test-renderer to address 4 CVEs. Fixed in 19.2.0-tuxcare.7.
- Record
CLSA-2026-1792287260- Updated
- 2026-11-02
OSVCLSA-2026-1792293013 No score
TuxCare security update for @next/polyfill-module (9 CVEs)
TuxCare rebuilt @next/polyfill-module to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792293013- Updated
- 2026-11-02
OSVCLSA-2026-1792304739 No score
TuxCare security update for @next/polyfill-nomodule (9 CVEs)
TuxCare rebuilt @next/polyfill-nomodule to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792304739- Updated
- 2026-11-02
OSVCLSA-2026-1792326303 No score
TuxCare security update for @next/react-refresh-utils (9 CVEs)
TuxCare rebuilt @next/react-refresh-utils to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792326303- Updated
- 2026-11-02
OSVCLSA-2026-1792338233 No score
TuxCare security update for @next/third-parties (2 CVEs)
TuxCare rebuilt @next/third-parties to address 2 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792338233- Updated
- 2026-11-02
OSVCLSA-2026-1792358588 No score
TuxCare security update for @next/codemod (9 CVEs)
TuxCare rebuilt @next/codemod to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792358588- Updated
- 2026-11-02
OSVCLSA-2026-1792363988 No score
TuxCare security update for @next/mdx (9 CVEs)
TuxCare rebuilt @next/mdx to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792363988- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-h25m-26qc-wcjf No score
GHSA-h25m-26qc-wcjf in next - Patched by Root
Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-h25m-26qc-wcjf- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
13.0.0 up to 15.0.8 | 15.0.8 |
nextnpm |
15.1.1-canary.0 up to 15.1.12 | 15.1.12 |
nextnpm |
15.2.0-canary.0 up to 15.2.9 | 15.2.9 |
nextnpm |
15.3.0-canary.0 up to 15.3.9 | 15.3.9 |
nextnpm |
15.4.0-canary.0 up to 15.4.11 | 15.4.11 |
nextnpm |
15.5.1-canary.0 up to 15.5.10 | 15.5.10 |
nextnpm |
15.6.0-canary.0 up to 15.6.0-canary.61 | 15.6.0-canary.61 |
nextnpm |
16.0.0-beta.0 up to 16.0.11 | 16.0.11 |
nextnpm |
16.1.0-canary.0 up to 16.1.5 | 16.1.5 |
react-server-dom-parcelnpm |
19.0.0 up to 19.0.6 | 19.0.6 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
react-server-dom-turbopacknpm |
19.0.0 up to 19.0.6 | 19.0.6 |
react-server-dom-webpacknpm |
19.0.0 up to 19.0.6 | 19.0.6 |
react-server-dom-parcelnpm |
19.1.0 up to 19.1.7 | 19.1.7 |
react-server-dom-turbopacknpm |
19.1.0 up to 19.1.7 | 19.1.7 |
react-server-dom-webpacknpm |
19.1.0 up to 19.1.7 | 19.1.7 |
react-server-dom-parcelnpm |
19.2.0 up to 19.2.6 | 19.2.6 |
react-server-dom-turbopacknpm |
19.2.0 up to 19.2.6 | 19.2.6 |
react-server-dom-webpacknpm |
19.2.0 up to 19.2.6 | 19.2.6 |
react-server-dom-esmTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.119.2.0-tuxcare.219.2.0-tuxcare.319.2.0-tuxcare.419.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-artTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-isTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-server-dom-turbopackTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-server-dom-webpackTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
create-next-appTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/eslint-plugin-nextTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/bundle-analyzerTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
react-server-dom-parcelTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
react-domTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.119.2.0-tuxcare.219.2.0-tuxcare.319.2.0-tuxcare.419.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
@next/plugin-storybookTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
react-test-rendererTuxCare:npm From an advisory covering 4 CVEs |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.7, plus listed versions 19.2.019.2.0-tuxcare.519.2.0-tuxcare.6 |
19.2.0-tuxcare.7 |
@next/polyfill-moduleTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/polyfill-nomoduleTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/react-refresh-utilsTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/third-partiesTuxCare:npm From an advisory covering 2 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/codemodTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/mdxTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
nextRoot:npm |
before 14.2.5-aikido.5 | 14.2.5-aikido.514.2.5-aikido.814.2.33-aikido.214.2.32-aikido.414.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.2.15-aikido.414.0.4-aikido.914.1.3-aikido.214.2.24-aikido.214.2.25-aikido.214.2.18-aikido.213.3.0-aikido.514.2.15-aikido.314.0.4-aikido.514.0.4-aikido.714.0.4-aikido.214.1.0-aikido.714.1.0-aikido.814.0.4-aikido.314.2.13-aikido.114.2.32-aikido.114.2.3-aikido.514.2.0-aikido.214.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.29-aikido.514.2.31-aikido.214.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.1.4-aikido.514.2.25-aikido.113.2.4-aikido.314.2.0-aikido.614.0.4-aikido.414.2.31-aikido.514.2.0-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.113.2.4-aikido.414.0.3-aikido.614.2.32-aikido.514.2.33-aikido.314.0.0-aikido.514.2.5-aikido.314.2.3-aikido.314.2.2-aikido.513.5.11-aikido.714.2.2-aikido.614.2.30-aikido.113.5.4-aikido.514.2.30-aikido.214.1.3-aikido.614.2.5-aikido.413.3.0-aikido.614.2.30-aikido.314.0.3-aikido.414.2.13-aikido.214.2.5-aikido.614.2.21-aikido.414.0.0-aikido.314.1.4-aikido.714.2.21-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.35-aikido.514.2.30-aikido.413.2.4-aikido.513.3.0-aikido.714.2.33-aikido.414.2.26-aikido.314.0.3-aikido.514.2.30-aikido.914.1.4-aikido.814.2.35-aikido.314.2.32-aikido.614.2.35-aikido.613.5.4-aikido.614.1.3-aikido.714.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.5-aikido.714.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.214.2.28-aikido.514.2.32-aikido.214.1.4-aikido.914.2.32-aikido.713.5.6-aikido.514.2.15-aikido.614.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.28-aikido.114.2.35-aikido.214.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.514.2.28-aikido.214.2.26-aikido.214.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.1.4-aikido.614.2.35-aikido.714.2.18-aikido.314.1.0-aikido.514.2.16-aikido.314.0.0-aikido.414.2.18-aikido.413.5.4-aikido.314.2.0-aikido.313.4.19-aikido.514.0.0-aikido.214.2.31-aikido.414.2.29-aikido.213.5.4-aikido.414.2.21-aikido.114.2.16-aikido.114.1.3-aikido.313.3.0-aikido.813.1.6-aikido.214.2.21-aikido.313.2.4-aikido.614.2.32-aikido.314.2.29-aikido.313.5.11-aikido.914.1.3-aikido.414.2.0-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.614.2.35-aikido.814.2.35-aikido.414.2.35-aikido.114.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1115.5.10-aikido.415.5.10-aikido.515.5.10-aikido.615.5.10-aikido.3 |
@rootio/nextRoot:npm |
before 14.2.5-root.io.5 | 14.2.5-root.io.514.2.5-root.io.814.2.33-root.io.214.2.32-root.io.414.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.2.15-root.io.414.0.4-root.io.914.1.3-root.io.214.2.25-root.io.214.2.24-root.io.214.2.18-root.io.213.3.0-root.io.514.2.15-root.io.314.0.4-root.io.514.0.4-root.io.714.0.4-root.io.214.1.0-root.io.714.1.0-root.io.814.0.4-root.io.314.2.13-root.io.114.2.32-root.io.114.2.3-root.io.514.2.0-root.io.214.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.29-root.io.514.2.31-root.io.214.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.1.4-root.io.514.2.25-root.io.113.2.4-root.io.314.2.0-root.io.614.0.4-root.io.414.2.31-root.io.514.2.0-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.113.2.4-root.io.414.0.3-root.io.614.2.32-root.io.514.2.33-root.io.314.0.0-root.io.514.2.5-root.io.314.2.3-root.io.313.5.4-root.io.514.2.2-root.io.513.5.11-root.io.714.2.2-root.io.614.2.30-root.io.114.2.30-root.io.214.1.3-root.io.614.2.5-root.io.413.3.0-root.io.614.2.30-root.io.314.0.3-root.io.414.2.13-root.io.214.2.5-root.io.614.2.21-root.io.414.0.0-root.io.314.1.4-root.io.714.2.21-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.35-root.io.514.2.30-root.io.413.2.4-root.io.513.3.0-root.io.714.2.33-root.io.414.2.26-root.io.314.0.3-root.io.514.2.30-root.io.914.1.4-root.io.814.2.35-root.io.314.2.32-root.io.614.2.35-root.io.613.5.4-root.io.614.1.3-root.io.714.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.5-root.io.714.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.214.2.28-root.io.514.2.32-root.io.214.1.4-root.io.914.2.32-root.io.713.5.6-root.io.514.2.15-root.io.613.2.4-root.io.714.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.28-root.io.114.2.33-root.io.514.2.35-root.io.213.5.6-root.io.613.5.11-root.io.814.2.26-root.io.514.2.28-root.io.214.2.26-root.io.214.0.4-root.io.814.2.28-root.io.314.2.31-root.io.314.2.35-root.io.714.1.4-root.io.614.2.18-root.io.314.1.0-root.io.514.2.16-root.io.314.0.0-root.io.414.2.18-root.io.413.5.4-root.io.314.2.0-root.io.313.4.19-root.io.514.0.0-root.io.214.2.31-root.io.414.2.29-root.io.213.5.4-root.io.414.2.21-root.io.114.1.3-root.io.314.2.16-root.io.113.3.0-root.io.813.1.6-root.io.214.2.21-root.io.313.2.4-root.io.614.2.32-root.io.314.2.29-root.io.313.5.11-root.io.914.1.3-root.io.414.2.0-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.614.2.35-root.io.814.2.35-root.io.413.5.6-root.io.714.2.35-root.io.114.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1115.5.10-root.io.415.5.10-root.io.515.5.10-root.io.615.5.10-root.io.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | dwisiswant0/next-16.2.4-pocs | 2026-05-07 |
| PoC in GitHub | emresandikci/nextjs-cve-2026-23870-checker | 2026-05-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-23870 is a high vulnerability (CVSS 7.5) in Facebook React-server-dom-parcel, published January 28, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 74th percentile. Fixed in next 15.0.8.
References
github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh
nvd.nist.gov/vuln/detail/CVE-2026-23864
vercel.com/changelog/summary-of-cve-2026-23864