Is CVE-2026-23869 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23869 being exploited in the wild.

How severe is CVE-2026-23869?

High severity, with a CVSS score of 7.5, published 8 April 2026.

Which products and versions are affected?

react-server-dom-parcel (npm) SEMVER:introduced=19.0.0,fixed=19.0.5; react-server-dom-turbopack (npm) SEMVER:introduced=19.0.0,fixed=19.0.5; react-server-dom-webpack (npm) SEMVER:introduced=19.0.0,fixed=19.0.5.

Is there a fix for CVE-2026-23869?

Yes. react-server-dom-parcel (npm): upgrade to 19.0.5 or later; react-server-dom-turbopack (npm): upgrade to 19.0.5 or later; react-server-dom-webpack (npm): upgrade to 19.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23869 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23869?

Check whether you run react-server-dom-parcel (npm), react-server-dom-turbopack (npm) or react-server-dom-webpack (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23869: Meta React Server Components denial of service in Server Functions

CVE-2026-23869 · Severity: high · CVSS 7.5 · Published 2026-04-08

React Server Components is a feature in the React JavaScript library that allows server-side rendering and computation. A denial of service vulnerability allows unauthenticated attackers to send specially crafted HTTP requests to applications using these components, causing the server to consume excessive CPU for up to a minute, potentially making the application unresponsive to legitimate users. This affects three related npm packages used by popular frameworks like Next.js and React Router.

Technologies: react-server-dom-parcel (npm), react-server-dom-turbopack (npm), react-server-dom-webpack (npm). Vendors: npm.

Quick answers

Is CVE-2026-23869 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23869 being exploited in the wild.
How severe is CVE-2026-23869?: High severity, with a CVSS score of 7.5, published 8 April 2026.
Which products and versions are affected?: react-server-dom-parcel (npm) SEMVER:introduced=19.0.0,fixed=19.0.5; react-server-dom-turbopack (npm) SEMVER:introduced=19.0.0,fixed=19.0.5; react-server-dom-webpack (npm) SEMVER:introduced=19.0.0,fixed=19.0.5.
Is there a fix for CVE-2026-23869?: Yes. react-server-dom-parcel (npm): upgrade to 19.0.5 or later; react-server-dom-turbopack (npm): upgrade to 19.0.5 or later; react-server-dom-webpack (npm): upgrade to 19.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23869 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23869?: Check whether you run react-server-dom-parcel (npm), react-server-dom-turbopack (npm) or react-server-dom-webpack (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

react-server-dom-parcel (npm): upgrade to 19.0.5 or later
```
npm install react-server-dom-parcel@19.0.5
```
react-server-dom-turbopack (npm): upgrade to 19.0.5 or later
```
npm install react-server-dom-turbopack@19.0.5
```
react-server-dom-webpack (npm): upgrade to 19.0.5 or later
```
npm install react-server-dom-webpack@19.0.5
```

Technical details

This vulnerability resides in the deserialization logic of React Server Components (CWE-502: Deserialization of Untrusted Data, CWE-400: Uncontrolled Resource Consumption). When a specially crafted HTTP request is sent to a Server Function endpoint, the deserialization process triggers an infinite loop or excessive resource allocation, causing the server process to hang and consume CPU for up to a minute before throwing a catchable error. The attack requires network access to the Server Function endpoint and no authentication or user interaction. An attacker can cause denial of service to all application users. Patches have been backported to versions 19.0.5, 19.1.6, and 19.2.5 of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.

Affected products

Meta react-server-dom-webpack 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, 19.2.0 through 19.2.4
Meta react-server-dom-parcel 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, 19.2.0 through 19.2.4
Meta react-server-dom-turbopack 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, 19.2.0 through 19.2.4

Identifiers

CVE-2026-23869
GHSA-479c-33wc-g2pg

Timeline

2026-04-10: disclosed: Vulnerability disclosed as GHSA-479c-33wc-g2pg
2026-04-10: patched: Patches released in versions 19.0.5, 19.1.6, and 19.2.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.