CVE-2026-23870: React Server DOM Packages DOS Vulnerability

CVE-2026-23870 Overview

CVE-2026-23870 is a denial of service vulnerability affecting React server function endpoints in the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages. Attackers can send specially crafted HTTP requests to trigger server crashes, out-of-memory exceptions, or excessive CPU usage. The flaw is exploitable over the network without authentication or user interaction. Affected versions span 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5.

Critical Impact

Unauthenticated remote attackers can crash React server processes or exhaust host CPU and memory by sending malformed payloads to server function endpoints.

Affected Products

• react-server-dom-webpack versions 19.0.0–19.0.5, 19.1.0–19.1.6, 19.2.0–19.2.5
• react-server-dom-parcel versions 19.0.0–19.0.5, 19.1.0–19.1.6, 19.2.0–19.2.5
• react-server-dom-turbopack versions 19.0.0–19.0.5, 19.1.0–19.1.6, 19.2.0–19.2.5

Discovery Timeline

• 2026-05-06 - CVE-2026-23870 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-23870

Vulnerability Analysis

The vulnerability resides in the request-handling path for React Server Components server functions. These endpoints accept serialized payloads from clients and reconstruct them on the server before invoking the corresponding server function. Crafted HTTP requests can drive the deserialization or argument-processing logic into pathological states. The result is a process crash, an unhandled out-of-memory exception, or sustained CPU consumption that starves other requests. Because the impact is limited to availability, confidentiality and integrity are not affected, but a single attacker can disrupt application service for all users.

Root Cause

The root cause is insufficient validation and resource bounding when parsing inbound payloads to server function endpoints. The packages do not adequately constrain the size, structure, or computational cost of the data they reconstruct, allowing adversarial inputs to amplify resource use. Refer to the GitHub Security Advisory GHSA-rv78-f8rc-xrxh for technical specifics.

Attack Vector

An unauthenticated attacker sends a specially crafted HTTP request to any exposed React server function endpoint. No privileges or user interaction are required. Repeated requests can be used to sustain a denial of service against the application server. The vulnerability is described in the React Security Advisory; no public exploit code is documented at this time.

Detection Methods for CVE-2026-23870

Indicators of Compromise

• Repeated HTTP POST requests to server function endpoints from a small set of source IPs preceding service degradation.
• Node.js process exits with JavaScript heap out of memory or unhandled exception traces referencing react-server-dom-* modules.
• Sustained CPU saturation on application servers correlated with bursts of inbound traffic to React server action routes.

Detection Strategies

• Inspect application logs for crashes or restarts originating in the react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack request handlers.
• Baseline normal request size and rate to server function endpoints, and alert on outliers in payload length or parse time.
• Correlate process restarts with upstream WAF or load balancer logs to identify the originating request signature.

Monitoring Recommendations

• Track Node.js memory and CPU metrics with alerting thresholds tuned to detect rapid resource exhaustion.
• Enable structured logging on reverse proxies to capture full request paths and payload sizes for server function routes.
• Monitor application restart counts and crash loops in container orchestrators such as Kubernetes.

How to Mitigate CVE-2026-23870

Immediate Actions Required

• Upgrade to a fixed release of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack as published in the GitHub Security Advisory GHSA-rv78-f8rc-xrxh.
• Inventory all applications using React 19.0.x, 19.1.x, or 19.2.x server components and prioritize internet-facing services.
• Place rate limiting and request-size limits in front of server function endpoints until patches are deployed.

Patch Information

The React project has published patched releases for the affected 19.0.x, 19.1.x, and 19.2.x lines. Consult the GitHub Security Advisory GHSA-rv78-f8rc-xrxh for the specific fixed versions and upgrade guidance.

Workarounds

• Enforce strict maximum request body sizes at the reverse proxy or web server tier for routes that handle server functions.
• Apply per-IP and per-route rate limits to reduce the throughput available to a single attacker.
• Run application processes under a process supervisor with memory limits and automatic restart to contain individual crashes.
• Restrict exposure of server function endpoints to authenticated users where the application architecture allows.

# Configuration example: nginx request size and rate limits for React server endpoints
http {
    limit_req_zone $binary_remote_addr zone=react_rsc:10m rate=20r/s;

    server {
        location /_rsc/ {
            client_max_body_size 64k;
            limit_req zone=react_rsc burst=40 nodelay;
            proxy_pass http://app_upstream;
        }
    }
}