CVE-2026-23870: High-Severity DoS Flaw in React Server Components

The National Vulnerability Database has disclosed CVE-2026-23870, a critical denial-of-service vulnerability impacting specific versions of React Server Components. Attackers can trigger server crashes, out-of-memory errors, or excessive CPU utilization by sending specially crafted HTTP requests to server function endpoints. This affects packages including react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack across several version ranges: 19.0.0-19.0.5, 19.1.0-19.1.6, and 19.2.0-19.2.5.

This vulnerability carries a CVSS score of 7.5 (HIGH), indicating a significant risk. The lack of authentication or user interaction required to exploit it (AV:N/AC:L/PR:N/UI:N) means any unauthenticated attacker on the network can potentially disrupt services. For defenders, this translates to a direct threat against application availability, potentially leading to significant downtime and operational impact if exploited.

Organizations relying on these affected React Server Component versions must prioritize patching. The National Vulnerability Database advises updating to a secure version. Proactive monitoring for unusual HTTP request patterns targeting server function endpoints is also recommended to detect potential exploitation attempts.