Facebook React-server-dom-webpack vulnerabilities

• facebook react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack +2 more Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components CVE-2026-23870 Public exploitFix available 7.5 HighJanuary 28, 2026