CVE-2026-23869: 
React Server Components vulnerability analysis and mitigation

CVE-2026-23869 is a Denial of Service (DoS) vulnerability in React Server Components, specifically affecting the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack npm packages. The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints, causing excessive CPU usage for up to one minute before terminating with a catchable error. Affected versions span 19.0.0–19.0.4, 19.1.0–19.1.5, and 19.2.0–19.2.4 across all three packages. It was published on April 8, 2026, with a CVSS v3.1 base score of 7.5 (High) (Github Advisory, React Security Advisory).

The vulnerability is rooted in two weaknesses: CWE-400 (Uncontrolled Resource Consumption) and CWE-502 (Deserialization of Untrusted Data), indicating that the React Flight protocol's deserialization logic fails to properly bound resource usage when processing attacker-controlled input. An unauthenticated remote attacker can send a specially crafted HTTP request payload to a Server Function (Server Action) endpoint, triggering a cyclic or pathological deserialization path that monopolizes CPU resources for up to 60 seconds. No authentication or user interaction is required, and attack complexity is low. A public PoC on GitHub describes the exploitation workflow, including how to locate valid action-id values by searching frontend code for createServerReference references (Github Advisory, PoC Repository).

Successful exploitation causes severe availability degradation on affected Node.js servers running React Server Components — each malicious request can pin CPU usage near 100% for up to one minute, making the server unresponsive to legitimate traffic during that window. Repeated requests can sustain a near-continuous denial of service condition. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue affecting any application using a supported framework or bundler (e.g., Next.js with Webpack, Parcel, or Turbopack) that exposes Server Function endpoints (Github Advisory, React Security Advisory).

A public proof-of-concept exploit is available on GitHub (PoC Repository), rated high confidence by Feedly threat intelligence, with a concrete exploitation workflow targeting unauthenticated Server Function endpoints. As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.84% (75th percentile), indicating a moderate near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Github Advisory).

1. Reconnaissance: Identify web applications using React Server Components with exposed Server Function endpoints. Search the application's frontend JavaScript bundles for calls to createServerReference to enumerate valid action-id values required to target Server Actions.
2. Identify target endpoint: Locate the Server Function (Server Action) HTTP endpoint — typically a POST route handled by the React server runtime (e.g., via Next.js App Router).
3. Craft malicious payload: Construct a specially crafted HTTP request body that exploits the React Flight protocol's deserialization logic, triggering a cyclic or computationally expensive deserialization path. Include the valid action-id in the request.
4. Send the request: Submit the crafted POST request to the Server Function endpoint without any authentication. The server's CPU will be consumed at high utilization for up to approximately 60 seconds.
5. Repeat for sustained DoS: Send repeated requests (potentially automated) to maintain continuous CPU exhaustion, effectively denying service to legitimate users for the duration of the attack (PoC Repository, Github Advisory).

• Network: Unusual volume of POST requests to Server Function/Server Action endpoints (e.g., paths handled by React's server runtime); requests with anomalous or oversized payloads targeting these endpoints from single or distributed sources.
• Logs: Server access logs showing repeated POST requests to RSC action endpoints with non-standard body content; application error logs showing repeated catchable errors thrown after ~60 seconds of processing.
• Process: Node.js server process sustaining near-100% CPU utilization for 60-second intervals, potentially cycling repeatedly; server response times spiking or timing out for legitimate requests during these windows.
• Application: Increased rate of server-side errors or timeouts correlated with specific endpoint paths; monitoring alerts for CPU saturation on application servers running Next.js or other RSC-enabled frameworks (PoC Repository).

The React team has released patched versions backporting the fix: 19.0.5, 19.1.6, and 19.2.5 for all three affected packages (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack). Upgrade immediately to the appropriate patched version. Applications that do not use React Server Components, or do not use a framework/bundler plugin that enables RSC (e.g., Next.js App Router, Parcel with RSC support), are not affected. As a network-layer workaround, Fastly has released a virtual patch and Cloudflare has added WAF rules to block exploitation attempts while patching is underway (Github Advisory, Fastly Changelog, Cloudflare Changelog).

The vulnerability (nicknamed React2DoS) received broad coverage across the security and developer communities shortly after disclosure. Vercel and Netlify both published changelogs acknowledging the issue and its impact on Next.js deployments, while Fastly and Cloudflare deployed virtual patches and WAF rules for their CDN/edge customers (Vercel Changelog, Netlify Changelog). Security researchers published technical write-ups analyzing the Flight protocol deserialization root cause, with Security Boulevard and CyCognito providing detailed breakdowns (Security Boulevard, CyCognito Blog). The vulnerability was discussed on Hacker News and featured in the Next.js Weekly and This Week in React newsletters, reflecting significant developer community awareness.