React
CVE-2026-23864
HIGH
GHSA-83fc-fqcc-2hmg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to Server Function endpoint
-
ExploitTrigger resource exhaustion in React Server Components
-
ImpactServer crashes or excessive memory/CPU consumption
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | React Server Components packages (react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack) with exposed Server Function endpoints. No authentication or special configuration required; remote unauthenticated exploitation against default deployments. |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to server crashes, out-of-memory exceptions or excessive CPU usage; depending on th. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Uncontrolled resource consumption in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) allows unauthenticated remote attackers to trigger denial of service through malformed requests to Server Function endpoints, causing server crashes, memory exhaustion, or CPU spikes. Applications using these packages are at risk of availability disruption. No patch is currently available; immediate mitigation and monitoring are recommended.
Earlier versions of this analysis (1)
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. [CVSS 7.5 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-400 (Uncontrolled Resource Consumption). Affects the React Server component of React. Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Strongly co
Know when React gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (fb).
CVSS VectorVendor: fb
Lifecycle Timeline
2DescriptionCVE.org
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
Executive ViewAI
A high-severity denial of service vulnerability affects React Server Components packages used in web applications, potentially enabling attackers to disrupt service availability. Organizations using react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack are at risk of application crashes and extended downtime until remediation is available.
Implement Web Application Firewall (WAF) rules to detect and block malformed requests targeting Server Component endpoints; deploy rate limiting and request throttling at load balancer and application levels; segment affected services to limit blast radius; enable enhanced logging and alerting for abnormal request patterns; consider disabling Server Components functionality if business-critical and patch unavailable.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-202
Pre-authentication denial of service in React Server Components (versions 19.0.0 through 19.2.1) allows unauthenticated
Information disclosure in React Server Components 19.x, distributed as react-server-dom-webpack, react-server-dom-turbop
react-native-keys version 0.7.11 contains a sensitive information disclosure vulnerability where encryption ciphers and
Unsafe deserialization in React Server Components Server Function endpoints allows remote unauthenticated attackers to t
HTML injection in Preact and React through unsafe JSON deserialization allows remote attackers to inject arbitrary scrip
Reflected XSS in Repostat's RepoCard React component prior to version 1.0.1 allows attackers to execute arbitrary JavaSc
OS command injection in create-react-app's react-dev-utils component enables remote code execution on macOS developer wo
Refine's @refinedev/inferencer package through version 7.0.0 interpolates API field names straight into generated JSX so
Simple Membership (WordPress plugin) versions up to 4.7.0 contains a security vulnerability (CVSS 6.5).
React-Router versions up to 6.30.1 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).
Wekan is an open source kanban tool built with Meteor. [CVSS 6.5 MEDIUM]
Exploit-DB