CVE-2026-23869: React Server Components DoS Vulnerability

CVE-2026-23869 Overview

A denial of service vulnerability exists in React Server Components, affecting the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages. The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints, causing excessive CPU usage for up to a minute before ultimately throwing a catchable error. This resource exhaustion vulnerability (CWE-400) can significantly impact the availability of applications built with React Server Components.

Critical Impact

Attackers can remotely trigger CPU exhaustion on affected React Server Component applications without authentication, potentially causing service degradation or complete denial of service for legitimate users.

Affected Products

• react-server-dom-parcel versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4
• react-server-dom-turbopack versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4
• react-server-dom-webpack versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4

Discovery Timeline

• 2026-04-08 - CVE-2026-23869 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-23869

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), representing an algorithmic complexity attack that can be triggered remotely without any prior authentication. The flaw resides in how React Server Components process incoming HTTP requests to Server Function endpoints.

When a maliciously crafted HTTP request payload is received, the server-side processing logic enters an inefficient execution path that consumes excessive CPU resources. The vulnerability allows attackers to degrade service performance for approximately one minute per malicious request, after which the operation terminates with an error that can be caught by application error handling.

The network-accessible nature of this vulnerability makes it particularly concerning for production applications, as attackers can exploit it from anywhere on the internet without needing valid credentials or user interaction.

Root Cause

The root cause lies in improper input validation and resource management within the Server Function request handling logic. The affected packages fail to properly limit or validate certain request payload characteristics, allowing specially crafted inputs to trigger computationally expensive operations that monopolize CPU resources.

Attack Vector

The attack is conducted over the network by sending HTTP requests with specially crafted payloads to Server Function endpoints exposed by React applications. The attack requires no authentication or privileges, and no user interaction is necessary for exploitation. An attacker can repeatedly send malicious requests to sustain the denial of service condition.

The vulnerability mechanism involves crafted HTTP request payloads that trigger inefficient processing patterns in the Server Function endpoint handlers. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-23869

Indicators of Compromise

• Abnormally high CPU utilization on servers running React Server Components without corresponding legitimate traffic increases
• Repeated HTTP requests to Server Function endpoints with unusual or malformed payload structures
• Application logs showing frequent errors or timeouts from Server Function processing after approximately 60-second execution periods
• Unusual patterns of POST requests to RSC endpoints from single or multiple source IPs

Detection Strategies

• Implement application performance monitoring to alert on sustained CPU usage spikes on React Server Component application servers
• Configure web application firewall rules to detect and rate-limit anomalous request patterns to Server Function endpoints
• Monitor Node.js process metrics for extended execution times and resource exhaustion patterns
• Review application error logs for patterns of timeout errors following resource-intensive request processing

Monitoring Recommendations

• Enable detailed request logging on Server Function endpoints to capture payload characteristics for forensic analysis
• Set up alerting thresholds for CPU utilization that consider baseline application performance
• Monitor network traffic patterns for volumetric anomalies targeting RSC endpoints
• Implement request tracing to correlate high CPU events with specific incoming requests

How to Mitigate CVE-2026-23869

Immediate Actions Required

• Audit your application dependencies to identify if react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack are in use within the affected version ranges
• Update affected packages to patched versions as soon as they become available from the React team
• Implement rate limiting on Server Function endpoints to reduce the impact of exploitation attempts
• Consider deploying additional infrastructure capacity to maintain availability during potential attacks

Patch Information

Refer to the GitHub Security Advisory for the latest patch information and updated package versions. Update your package.json dependencies and run npm update or yarn upgrade to install patched versions of the affected packages.

Workarounds

• Implement aggressive rate limiting on Server Function endpoints at the reverse proxy or load balancer level
• Deploy web application firewall rules to filter requests with suspicious payload characteristics
• Add request timeout configurations at the application server level to terminate long-running requests before full CPU exhaustion occurs
• Consider temporarily disabling non-essential Server Function endpoints until patches can be applied

# Example: Rate limiting configuration for nginx reverse proxy
limit_req_zone $binary_remote_addr zone=rsc_limit:10m rate=10r/s;

location /api/server-functions {
    limit_req zone=rsc_limit burst=20 nodelay;
    proxy_pass http://react_app;
    proxy_read_timeout 30s;
}