CVE-2026-23864 React Server Components have multiple Denial of Service Vulnerabilities
Attackers can cause server crashes or resource exhaustion in React Server Components applications by sending crafted HTTP requests to Server Function endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23864?
CVE-2026-23864 is a high-severity denial of service vulnerability in Meta react-server-dom-parcel, published on 26 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
Which versions are affected by CVE-2026-23864?
18 open source packages ship an affected version, including react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
react-server-dom-parcel npm | From 19.0.0 | 19.0.4 |
react-server-dom-parcel npm | From 19.0.0 | 19.0.4 |
react-server-dom-parcel npm | From 19.1.0-canary-7130d0c6-20241212 | 19.1.5 |
react-server-dom-parcel npm | From 19.1.0-canary-7130d0c6-20241212 | 19.1.5 |
react-server-dom-parcel npm | From 19.2.0-canary-63779030-20250328 | 19.2.4 |
react-server-dom-parcel npm | From 19.2.0-canary-63779030-20250328 | 19.2.4 |
12 more packages
react-server-dom-turbopack npm | From 19.0.0 | 19.0.4 |
react-server-dom-turbopack npm | From 19.0.0 | 19.0.4 |
react-server-dom-turbopack npm | From 19.1.0-canary-7130d0c6-20241212 | 19.1.5 |
react-server-dom-turbopack npm | From 19.1.0-canary-7130d0c6-20241212 | 19.1.5 |
react-server-dom-turbopack npm | From 19.2.0-canary-63779030-20250328 | 19.2.4 |
react-server-dom-turbopack npm | From 19.2.0-canary-63779030-20250328 | 19.2.4 |
react-server-dom-webpack npm | From 19.0.0 | 19.0.4 |
react-server-dom-webpack npm | From 19.0.0 | 19.0.4 |
react-server-dom-webpack npm | From 19.1.0-canary-7130d0c6-20241212 | 19.1.5 |
react-server-dom-webpack npm | From 19.1.0-canary-7130d0c6-20241212 | 19.1.5 |
react-server-dom-webpack npm | From 19.2.0-canary-63779030-20250328 | 19.2.4 |
react-server-dom-webpack npm | From 19.2.0-canary-63779030-20250328 | 19.2.4 |
Products include Facebook React.
How do I fix CVE-2026-23864?
Upgrade react-server-dom-parcel to a fixed version for your release line: 19.0.4, 19.1.5 or 19.2.4.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-23864 being exploited?
There is no known exploitation of CVE-2026-23864 in the wild and no public exploit code.
Other vulnerabilities in Meta react-server-dom-parcel
- CVE-2025-55182 Meta React Server Components Remote Code Execution
- CVE-2025-55184 Denial of Service Vulnerability in React Server Components
- CVE-2025-67779 Denial of Service Vulnerability in React Server Components
- CVE-2018-6341 Cross-Site Scripting in react-dom
- CVE-2025-55183 Source Code Exposure Vulnerability in React Server Components
Sources
Also known as GHSA-83fc-fqcc-2hmg.