Next.js and React denial of service in Server Components

Severity: high · CVSS 7.5 · Published 2026-05-11

A vulnerability in the React Server Components used by Next.js and other web frameworks can allow an attacker to crash a website or make it unresponsive. By sending a specially crafted request to the server, an attacker can force the system to consume excessive processor power or memory. This results in a denial of service, preventing legitimate users from accessing the application.

Technologies: Meta React Server Components (Parcel), Meta React Server Components (Turbopack), Meta React Server Components (Webpack), Vercel Next.js, Vite Plugin-Rsc. Vendors: Meta, Vercel, Vite.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.5, published 11 May 2026.
Which products and versions are affected?
Meta React Server Components (Parcel) 19.0.0 - 19.0.5, 19.1.0 - 19.1.6, 19.2.0 - 19.2.5; Meta React Server Components (Turbopack) 19.0.0 - 19.0.5, 19.1.0 - 19.1.6, 19.2.0 - 19.2.5; Meta React Server Components (Webpack) 19.0.0 - 19.0.5, 19.1.0 - 19.1.6, 19.2.0 - 19.2.5; Vercel Next.js >= 13.0.0, < 15.5.16; >= 16.0.0, < 16.2.5; and 1 more.
Is there a fix for This vulnerability?
A patch was published on 2026-05-06: Fixes released for Next.js and React packages Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Meta React Server Components (Parcel), Meta React Server Components (Turbopack), Meta React Server Components (Webpack) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial of service vulnerability exists in React Server Components (RSC) packages (webpack, parcel, and turbopack variants) and frameworks that implement them, such as Next.js. The root cause is a failure to properly limit resource allocation during the deserialization of RSC data sent to Server Function endpoints (CWE-770, CWE-400). A remote, unauthenticated attacker can send a specially crafted HTTP request to any App Router Server Function endpoint to trigger excessive CPU usage or out-of-memory (OOM) exceptions. This vulnerability is tracked upstream as CVE-2026-23870. Patches are available in Next.js versions 15.5.16 and 16.2.5, and React versions 19.0.6, 19.1.7, and 19.2.6.

Affected products

  • Vercel Next.js >= 13.0.0, < 15.5.16; >= 16.0.0, < 16.2.5
  • Facebook React Server Components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) 19.0.0 - 19.0.5, 19.1.0 - 19.1.6, 19.2.0 - 19.2.5
  • Vite @vitejs/plugin-rsc <= 0.5.25

Timeline

  • 2026-05-06: disclosed: Initial advisory publication by Vercel and Facebook
  • 2026-05-06: patched: Fixes released for Next.js and React packages
  • 2026-05-11: advisory: GitHub Advisory Database entry reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.