PT-2026-31432 · Meta · React Server Components

Bzimport · CVE-2026-23869 · Published 2026-04-08 · Updated 2026-05-08

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4.

Description: A denial of service vulnerability exists in React Server Components. The issue is triggered by sending specially crafted HTTP requests to Server Function endpoints. The payload of the HTTP request causes excessive CPU usage for up to a minute, resulting in a catchable error. This can lead to a denial of service.

Recommendations: Upgrade to versions 19.0.5, 19.1.6, or 19.2.5.

Fix

DoS

Resource Exhaustion

Deserialization of Untrusted Data

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-502

CWE-770

Related Identifiers

CVE-2026-23869

GHSA-479C-33WC-G2PG

Affected Products

React Server Components

References · 26

• https://nvd.nist.gov/vuln/detail/CVE-2026-23869 · Security Note
• https://osv.dev/vulnerability/GHSA-479c-33wc-g2pg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23869 · Vendor Advisory
• https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg · Note
• https://github.com/facebook/react · Note
• https://twitter.com/changewatchdev/status/2045223273433063710 · Twitter Post
• https://twitter.com/RonMasas/status/2042280056894972363 · Twitter Post
• https://twitter.com/vibeshield/status/2048129996665790965 · Twitter Post
• https://reddit.com/r/TheSailor/comments/1t714od/critical_nextjs_and_react_server_components · Reddit Post
• https://twitter.com/VulmonFeeds/status/2042016467378381125 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2026-23869 · Note
• https://twitter.com/Cloudforce_One/status/2042400658813501474 · Twitter Post
• https://twitter.com/RigneySec/status/2042299656072544498 · Twitter Post
• https://twitter.com/changewatchdev/status/2042117811040878951 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2042177041613857024 · Twitter Post