CVE-2026-23869 React Server Components have a Denial of Service Vulnerability
Attackers can cause denial of service in React Server Components by sending crafted HTTP requests that trigger excessive CPU usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23869?
CVE-2026-23869 is a high-severity denial of service vulnerability in Meta react-server-dom-parcel, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
Which versions are affected by CVE-2026-23869?
18 open source packages ship an affected version, including react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack.
| Package | Affected | Fixed in |
|---|---|---|
react-server-dom-parcel npm | From 19.0.0 | 19.0.5 |
react-server-dom-parcel npm | From 19.0.0 | 19.0.5 |
react-server-dom-parcel npm | From 19.1.0 | 19.1.6 |
react-server-dom-parcel npm | From 19.1.0 | 19.1.6 |
react-server-dom-parcel npm | From 19.2.0 | 19.2.5 |
react-server-dom-parcel npm | From 19.2.0 | 19.2.5 |
12 more packages
react-server-dom-turbopack npm | From 19.0.0 | 19.0.5 |
react-server-dom-turbopack npm | From 19.0.0 | 19.0.5 |
react-server-dom-turbopack npm | From 19.1.0 | 19.1.6 |
react-server-dom-turbopack npm | From 19.1.0 | 19.1.6 |
react-server-dom-turbopack npm | From 19.2.0 | 19.2.5 |
react-server-dom-turbopack npm | From 19.2.0 | 19.2.5 |
react-server-dom-webpack npm | From 19.0.0 | 19.0.5 |
react-server-dom-webpack npm | From 19.0.0 | 19.0.5 |
react-server-dom-webpack npm | From 19.1.0 | 19.1.6 |
react-server-dom-webpack npm | From 19.1.0 | 19.1.6 |
react-server-dom-webpack npm | From 19.2.0 | 19.2.5 |
react-server-dom-webpack npm | From 19.2.0 | 19.2.5 |
How do I fix CVE-2026-23869?
Upgrade react-server-dom-parcel to a fixed version for your release line: 19.0.5, 19.1.6 or 19.2.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-23869 being exploited?
There is no known exploitation of CVE-2026-23869 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as GHSA-479c-33wc-g2pg.