Executive brief
A vulnerability in the Vite plugin for React Server Components (RSC) can allow an attacker to crash a web server or make it unresponsive. This occurs because the plugin uses a version of a React library that does not properly handle certain types of incoming data. An exploit could lead to a service outage, preventing customers from accessing the application.
Technical details
The @vitejs/plugin-rsc package vendors react-server-dom-webpack, which is vulnerable to a Denial of Service (DoS) attack. The vulnerability (CVE-2026-23870) is categorized as CWE-770, involving the allocation of resources without limits or throttling during the deserialization of React Server Components. A remote, unauthenticated attacker can send a specially crafted HTTP request to a server function endpoint to trigger excessive CPU usage, out-of-memory exceptions, or server crashes. The issue is fixed in @vitejs/plugin-rsc version 0.5.26 by updating the underlying React dependencies to version 19.2.6 or later.
Affected products
- Vite @vitejs/plugin-rsc <= 0.5.25
Timeline
- 2026-05-06: disclosed: Upstream React and Next.js advisories published
- 2026-05-07: advisory: Vite plugin advisory published
- 2026-05-11: patched: GitHub advisory reviewed and updated