CVE-2026-23864: React Server Components DoS Vulnerability

CVE-2026-23864 Overview

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, potentially leading to server crashes, out-of-memory exceptions, or excessive CPU usage depending on the vulnerable code path being exercised, the application configuration, and application code.

This resource exhaustion vulnerability (CWE-400) allows unauthenticated remote attackers to disrupt service availability for applications built with React Server Components.

Critical Impact

Remote attackers can crash servers or exhaust system resources by sending malicious HTTP requests to React Server Function endpoints, causing complete service disruption for affected web applications.

Affected Products

• react-server-dom-parcel (vulnerable versions)
• react-server-dom-turbopack (vulnerable versions)
• react-server-dom-webpack (vulnerable versions)

Discovery Timeline

• 2026-01-26 - CVE-2026-23864 published to NVD
• 2026-01-27 - Last updated in NVD database

Technical Details for CVE-2026-23864

Vulnerability Analysis

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which occurs when an application fails to properly manage system resources when processing external input. In the context of React Server Components, the Server Function endpoints do not adequately validate or limit incoming HTTP request payloads, allowing attackers to craft requests that consume excessive server resources.

The attack can manifest in multiple ways depending on the specific code path exercised. Server crashes may occur when the application encounters unexpected input that triggers unhandled exceptions. Out-of-memory exceptions can be triggered when malicious requests cause the server to allocate excessive memory without proper bounds checking. CPU exhaustion scenarios arise when specially crafted inputs force the server into computationally expensive operations.

Root Cause

The root cause stems from insufficient input validation and resource management in the React Server Components request handling logic. The Server Function endpoints process incoming HTTP requests without adequate safeguards against malformed or oversized payloads, allowing attackers to exploit the lack of resource consumption limits.

Attack Vector

The vulnerability is exploitable over the network without requiring any authentication or user interaction. An attacker can send specially crafted HTTP requests directly to exposed Server Function endpoints. The low attack complexity means that standard HTTP client tools can be used to deliver malicious payloads.

Attack scenarios include:

• Sending malformed request bodies that trigger parsing errors leading to crashes
• Submitting oversized payloads that cause memory allocation failures
• Crafting requests that trigger computationally expensive server-side operations
• Exploiting serialization/deserialization weaknesses in the request handling pipeline

Detection Methods for CVE-2026-23864

Indicators of Compromise

• Unusual spikes in HTTP request volume targeting Server Function endpoints
• Server processes exhibiting abnormally high memory consumption
• Increased CPU utilization without corresponding legitimate traffic increases
• Application server crashes or restarts in close succession
• Out-of-memory errors in application logs

Detection Strategies

• Monitor application logs for repeated server crashes or out-of-memory exceptions
• Implement anomaly detection for HTTP request patterns targeting React Server Components endpoints
• Configure alerts for unusual resource consumption patterns on application servers
• Review web server access logs for suspicious request patterns or oversized payloads
• Deploy application performance monitoring to detect degradation in response times

Monitoring Recommendations

• Enable detailed logging for Server Function endpoint requests
• Configure resource monitoring dashboards for memory and CPU usage trends
• Set up automated alerts when server restarts exceed normal thresholds
• Implement request rate limiting and monitor for blocked requests
• Use SentinelOne Singularity Platform to detect and alert on anomalous process behavior

How to Mitigate CVE-2026-23864

Immediate Actions Required

• Upgrade react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack to the latest available versions
• Implement rate limiting on Server Function endpoints to prevent request flooding
• Configure web application firewall rules to filter malformed or oversized requests
• Review application code for custom Server Functions that may be particularly vulnerable
• Enable health monitoring and auto-restart capabilities for application servers

Patch Information

Facebook has released security updates addressing this vulnerability. Refer to the Facebook Security Advisory for specific version information and upgrade instructions. Organizations should prioritize upgrading to the latest package versions to reduce risk and prevent availability issues.

Workarounds

• Implement request size limits at the web server or load balancer level
• Deploy a web application firewall with rules to detect and block malicious payloads
• Configure resource limits (memory, CPU) for application server processes to prevent complete system exhaustion
• Use container orchestration health checks to automatically restart crashed instances
• Consider temporarily restricting access to Server Function endpoints if immediate patching is not feasible

# Example nginx configuration for request limits
# Add to server block for React Server Components application

# Limit request body size
client_max_body_size 1m;

# Limit request rate per IP
limit_req_zone $binary_remote_addr zone=server_funcs:10m rate=10r/s;

location /api/server-functions {
    limit_req zone=server_funcs burst=20 nodelay;
    proxy_pass http://app_backend;
}