CVE-2026-23864: Meta React Server Components denial of service in Server Function endpoints

CVE-2026-23864 · Severity: high · CVSS 7.5 · Published 2026-01-26

Multiple denial of service vulnerabilities exist in React Server Components, a technology used to build modern web applications. By sending specially crafted web requests, an attacker can cause the server to crash, run out of memory, or consume excessive processor resources. This can lead to application downtime and service unavailability for customers.

Technologies: react-server-dom-parcel (npm), react-server-dom-turbopack (npm), react-server-dom-webpack (npm), Red Hat Streams for Apache Kafka. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-23864 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-23864 being exploited in the wild.
How severe is CVE-2026-23864?
High severity, with a CVSS score of 7.5, published 26 January 2026.
Which products and versions are affected?
react-server-dom-parcel (npm) SEMVER:introduced=19.0.0,fixed=19.0.4; react-server-dom-turbopack (npm) SEMVER:introduced=19.1.0-canary-7130d0c6-20241212,fixed=19.1.5; react-server-dom-webpack (npm) SEMVER:introduced=19.2.0-canary-63779030-20250328,fixed=19.2.4; Red Hat Streams for Apache Kafka 3.2.0.
Is there a fix for CVE-2026-23864?
Yes. react-server-dom-parcel (npm): upgrade to 19.0.4 or later; react-server-dom-turbopack (npm): upgrade to 19.1.5 or later; react-server-dom-webpack (npm): upgrade to 19.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23864 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-23864?
Check whether you run react-server-dom-parcel (npm), react-server-dom-turbopack (npm), react-server-dom-webpack (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • react-server-dom-parcel (npm): upgrade to 19.0.4 or later
    npm install react-server-dom-parcel@19.0.4
  • react-server-dom-turbopack (npm): upgrade to 19.1.5 or later
    npm install react-server-dom-turbopack@19.1.5
  • react-server-dom-webpack (npm): upgrade to 19.2.4 or later
    npm install react-server-dom-webpack@19.2.4

Technical details

The vulnerabilities involve uncontrolled resource consumption (CWE-400) and potentially unsafe deserialization (CWE-502) within React Server Components. An unauthenticated remote attacker can trigger these flaws by sending specially crafted HTTP requests to Server Function endpoints. Depending on the specific code path and application configuration, this can result in server crashes, out-of-memory (OOM) exceptions, or sustained high CPU usage. The issue affects the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages. Patches are available in versions 19.0.4, 19.1.5, and 19.2.4.

Affected products

  • Meta react-server-dom-parcel 19.0.0 to 19.0.3, 19.1.0 to 19.1.4, 19.2.0 to 19.2.3
  • Meta react-server-dom-turbopack 19.0.0 to 19.0.3, 19.1.0 to 19.1.4, 19.2.0 to 19.2.3
  • Meta react-server-dom-webpack 19.0.0 to 19.0.3, 19.1.0 to 19.1.4, 19.2.0 to 19.2.3
  • Red Hat Streams for Apache Kafka 3.2.0

Identifiers

  • CVE-2026-23864
  • GHSA-83fc-fqcc-2hmg

Timeline

  • 2026-01-26: disclosed
  • 2026-01-26: advisory
  • 2026-05-04: patched: Red Hat released updates for Streams for Apache Kafka

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.