PT-2026-31432 · Meta · React Server Components

Published 2026-04-08 · Updated 2026-05-08 · CVE-2026-23869

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4.

Description: A denial of service vulnerability exists in React Server Components. The issue is triggered by sending specially crafted HTTP requests to Server Function endpoints. The payload of the HTTP request causes excessive CPU usage for up to a minute, resulting in a catchable error. This can lead to a denial of service.

Recommendations: Upgrade to versions 19.0.5, 19.1.6, or 19.2.5.

Fix

DoS

Deserialization of Untrusted Data

Resource Exhaustion

Weakness Enumeration

CWE-502

CWE-400

Related Identifiers

CVE-2026-23869

GHSA-479C-33WC-G2PG

Affected Products

React Server Components

References · 22

• https://osv.dev/vulnerability/GHSA-479c-33wc-g2pg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23869 · Security Note
• https://github.com/facebook/react · Note
• https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg · Note
• https://twitter.com/Cloudforce_One/status/2042400658813501474 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042016467378381125 · Twitter Post
• https://reddit.com/r/TheSailor/comments/1t714od/critical_nextjs_and_react_server_components · Reddit Post
• https://twitter.com/vibeshield/status/2048129996665790965 · Twitter Post
• https://twitter.com/Bwatson/status/2042268945424720142 · Twitter Post
• https://twitter.com/cyberkendra/status/2042654027574579257 · Twitter Post
• https://twitter.com/vibeshield/status/2047767606677889499 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2042177041613857024 · Twitter Post
• https://twitter.com/changewatchdev/status/2045223273433063710 · Twitter Post
• https://t.me/CVEtracker/50083 · Telegram Post
• https://twitter.com/RigneySec/status/2042299656072544498 · Twitter Post