What is the CVSS score of CVE-2026-23870?

CVE-2026-23870 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of React Server Components are affected by CVE-2026-23870?

React Server Components in versions 19.0.0-19.2.5 are vulnerable to unauthenticated remote denial-of-service attacks that can crash production servers or exhaust system resources through malformed…. A patch is available.

How to fix or mitigate CVE-2026-23870?

Within 24 hours: Inventory all production and development environments running react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack versions 19.0.0-19.0.5, 19.1.0-19.1.6, or 19.2.0-19.2.5; implement network-level rate limiting on server function endpoints. Within 7 days: Monitor Meta's React advisory channels and npm package repository for patch releases targeting affected versions; test patch availability by checking npm package pages for each affected package. Within 30 days: Apply vendor-released patch immediately upon availability, or if no patch is released, evaluate upgrading to React 20+ or alternative server-side frameworks; validate remediation in staging environment before production deployment.

React Server Components CVE-2026-23870

EUVD-2026-27867 HIGH

2026-05-06 Meta

GHSA-rv78-f8rc-xrxh

Denial Of Service Red Hat

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 17:33 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

10 npm packages depend on react-server-dom-webpack (6 direct, 4 indirect)

Ecosystem-wide dependent count for version 19.0.0.

DescriptionCVE.org

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).

AnalysisAI

Remote denial of service in React Server Components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) versions 19.0.0-19.0.5, 19.1.0-19.1.6, and 19.2.0-19.2.5 allows unauthenticated remote attackers to crash servers, trigger out-of-memory exceptions, or exhaust CPU resources by sending specially crafted HTTP requests to server function endpoints. The CVSS 7.5 score reflects network-accessible, low-complexity exploitation requiring no privileges or user interaction, with high availability impact. No public exploit code or active exploitation confirmed at time of analysis, though EPSS data unavailable and vulnerability disclosed by Meta directly.

Technical ContextAI

This vulnerability affects React Server Components (RSC), Meta's framework for server-side rendering React applications with server-client data streaming. The affected packages (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) are bundler-specific implementations that handle serialization and deserialization of server function calls over HTTP. The vulnerability lies in how these packages process HTTP requests targeting server function endpoints, likely involving inadequate input validation, resource limits, or error handling in the request parsing or execution layer. Without a CWE classification, the root cause class is unspecified, but the symptoms (crashes, OOM, CPU exhaustion) suggest potential issues such as algorithmic complexity attacks, unbounded resource consumption, or improper handling of malformed payloads during server action invocations.

RemediationAI

Upgrade to patched versions immediately per Meta's security advisory at https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh (exact patched versions not specified in provided data but likely 19.0.6+, 19.1.7+, and 19.2.6+ based on affected version ranges). Until patching is possible, implement rate limiting on server function endpoints to mitigate CPU exhaustion and memory consumption attacks, though this does not prevent crashes from malformed requests. Deploy application-layer firewalls or reverse proxies with request size limits and payload validation to filter malicious HTTP requests before they reach React Server Components. Monitor server resource usage (CPU, memory) and configure automatic restarts with crash recovery to maintain availability during potential attacks, though this is a reactive control that does not prevent exploitation. Consider temporarily disabling server functions in non-critical features if patching cannot be deployed immediately, though this may impact application functionality. Note that rate limiting may affect legitimate high-volume users, and payload filtering requires understanding valid request patterns to avoid blocking legitimate traffic.