PT-2026-31432 · Meta · React Server Components

Published 2026-04-08 · Updated 2026-04-10 · CVE-2026-23869

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions React Server Components versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4

Description A denial of service issue exists in React Server Components. Sending specially crafted HTTP requests to Server Function endpoints can cause excessive CPU usage for up to a minute, resulting in an error. The payload of the HTTP request triggers this behavior.

Recommendations Update to a version later than 19.2.4.

Fix

DoS

Deserialization of Untrusted Data

Resource Exhaustion

Weakness Enumeration

CWE-502

CWE-400

Related Identifiers

CVE-2026-23869

GHSA-479C-33WC-G2PG

Affected Products

React Server Components

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-23869 · Security Note
• https://osv.dev/vulnerability/GHSA-479c-33wc-g2pg · Vendor Advisory
• https://github.com/facebook/react · Note
• https://twitter.com/RonMasas/status/2042280056894972363 · Twitter Post
• https://twitter.com/Cloudforce_One/status/2042400658813501474 · Twitter Post
• https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components · Note
• https://twitter.com/Bwatson/status/2042268945424720142 · Twitter Post
• https://twitter.com/omvapt/status/2042561737547739244 · Twitter Post
• https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg · Note
• https://twitter.com/changewatchdev/status/2042117811040878951 · Twitter Post
• https://twitter.com/RigneySec/status/2042299656072544498 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2042177041613857024 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042016467378381125 · Twitter Post
• https://twitter.com/cyberkendra/status/2042654027574579257 · Twitter Post