CVE-2026-23864: High severity npm/react-server-dom-parcel vulnerability
Impact
It was found that the fixes to address DoS in React Server Components were incomplete and we found multiple denial of service vulnerabilities still exist in React Server Components.
We recommend updating immediately.
The vulnerability exists in versions 19.0.0, 19.0.1, 19.0.2, 19.0.3, 19.1.0, 19.1.1, 19.1.2, 19.1.3, 19.1.4, 19.2.0, 19.2.1, 19.2.2, 19.2.3 of:
- react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Patches
Fixes were back ported to versions 19.0.4, 19.1.5, and 19.2.4.
If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
References
See the blog post for more information and upgrade instructions.
Other sources
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/react-server-dom-turbopackto a version that resolves this vulnerability.Fixed in 19.2.4 - Upgrade
Upgrade
npm/react-server-dom-webpackto a version that resolves this vulnerability.Fixed in 19.0.4 - Upgrade
Upgrade
npm/react-server-dom-webpackto a version that resolves this vulnerability.Fixed in 19.1.5 - Upgrade
Upgrade
npm/react-server-dom-parcelto a version that resolves this vulnerability.Fixed in 19.2.4 - Upgrade
Upgrade
npm/react-server-dom-parcelto a version that resolves this vulnerability.Fixed in 19.1.5 - Upgrade
Upgrade
npm/react-server-dom-turbopackto a version that resolves this vulnerability.Fixed in 19.0.4 - Upgrade
Upgrade
npm/react-server-dom-webpackto a version that resolves this vulnerability.Fixed in 19.2.4 - Upgrade
Upgrade
npm/react-server-dom-turbopackto a version that resolves this vulnerability.Fixed in 19.1.5 - Upgrade
Upgrade
npm/react-server-dom-parcelto a version that resolves this vulnerability.Fixed in 19.0.4 - Upgrade
Upgrade
react-server-dom-parcelto a version that resolves this vulnerability.Fixed in 19.0.4 - Upgrade
Upgrade
react-server-dom-turbopackto a version that resolves this vulnerability.Fixed in 19.1.5 - Upgrade
Upgrade
react-server-dom-webpackto a version that resolves this vulnerability.Fixed in 19.2.4 - Compensating control
Until upgraded, reduce exposure by ensuring Server Function endpoints that use React Server Components are protected against specially crafted HTTP requests (e.g., add rate limiting/WAF rules in front of the endpoints) to mitigate the denial-of-service conditions that can cause server crashes, out-of-memory exceptions, or excessive CPU usage.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23864?
CVE-2026-23864 is classified as a denial of service vulnerability.
What software packages are affected by CVE-2026-23864?
CVE-2026-23864 affects react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack.
How do I fix CVE-2026-23864?
To fix CVE-2026-23864, update the affected packages to their latest versions as recommended by the maintainers.
What causes CVE-2026-23864 to be exploited?
CVE-2026-23864 can be exploited by sending specially crafted HTTP requests to Server Function endpoints.
Are there any mitigations for CVE-2026-23864?
Yes, implementing input validation on Server Function endpoints can help mitigate the effects of CVE-2026-23864.