CVE-2026-23870: Facebook React Denial of Service in React Server Components

CVE-2026-23870 · Severity: high · CVSS 7.5 · Published 2026-05-06

A vulnerability in Facebook's React Server Components can allow an attacker to crash a web application or make it unresponsive. By sending specifically designed web requests to the server, an attacker can force the application to consume all available memory or processor power. This results in a denial of service, preventing legitimate users from accessing the site or its features. Applications using modern React frameworks like Next.js are primarily at risk and should be updated immediately.

Technologies: react-server-dom-parcel (npm), react-server-dom-turbopack (npm), react-server-dom-webpack (npm), Vercel Next.js, Vite Plugin-Rsc. Vendors: Facebook, npm, Vercel, Vite.

Quick answers

Is CVE-2026-23870 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-23870 being exploited in the wild.
How severe is CVE-2026-23870?
High severity, with a CVSS score of 7.5, published 6 May 2026.
Which products and versions are affected?
react-server-dom-parcel (npm) SEMVER:introduced=19.0.0,fixed=19.0.6; react-server-dom-turbopack (npm) SEMVER:introduced=19.0.0,fixed=19.0.6; react-server-dom-webpack (npm) SEMVER:introduced=19.0.0,fixed=19.0.6; Vercel Next.js >= 13.0.0, < 15.5.16; >= 16.0.0, < 16.2.5; and 1 more.
Is there a fix for CVE-2026-23870?
Yes. react-server-dom-parcel (npm): upgrade to 19.0.6 or later; react-server-dom-turbopack (npm): upgrade to 19.0.6 or later; react-server-dom-webpack (npm): upgrade to 19.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23870 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-23870?
Check whether you run Facebook React-Server-Dom-Parcel, Facebook React-Server-Dom-Turbopack, Facebook React-Server-Dom-Webpack or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • react-server-dom-parcel (npm): upgrade to 19.0.6 or later
    npm install react-server-dom-parcel@19.0.6
  • react-server-dom-turbopack (npm): upgrade to 19.0.6 or later
    npm install react-server-dom-turbopack@19.0.6
  • react-server-dom-webpack (npm): upgrade to 19.0.6 or later
    npm install react-server-dom-webpack@19.0.6

Technical details

A denial of service vulnerability exists in React Server Components (RSC) due to uncontrolled resource consumption (CWE-400) during the deserialization of server function endpoints. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP requests to these endpoints, triggering out-of-memory (OOM) exceptions or excessive CPU utilization. The flaw specifically impacts the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages. Downstream frameworks such as Next.js (App Router) and Vite plugins that vendor these packages are also affected. Patches have been released in React versions 19.0.6, 19.1.7, and 19.2.6, as well as corresponding framework updates.

Affected products

  • Facebook react-server-dom-webpack 19.0.0 - 19.0.5, 19.1.0 - 19.1.6, 19.2.0 - 19.2.5
  • Facebook react-server-dom-parcel 19.0.0 - 19.0.5, 19.1.0 - 19.1.6, 19.2.0 - 19.2.5
  • Facebook react-server-dom-turbopack 19.0.0 - 19.0.5, 19.1.0 - 19.1.6, 19.2.0 - 19.2.5
  • Vercel next.js >= 13.0.0, < 15.5.16; >= 16.0.0, < 16.2.5
  • Vite @vitejs/plugin-rsc <= 0.5.25

Identifiers

  • CVE-2026-23870
  • GHSA-rv78-f8rc-xrxh

Timeline

  • 2026-05-06: disclosed: Initial disclosure and NVD receipt
  • 2026-05-11: advisory: GitHub Advisory published and reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.