CVE-2026-23869: Denial of Service Vulnerability in React Server Components
Summary
CVE-2026-23869: React Server Components have a Denial of Service Vulnerability. Affects react-server-dom-parcel across 3 version ranges.
>= 19.0.0, < 19.0.5
>= 19.1.0, < 19.1.6
>= 19.2.0, < 19.2.5
Fixed in 19.0.5, 19.1.6 or 19.2.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React Server Components are a feature of React that allow developers to build modern web applications with server-side rendering capabilities. They enable the creation of components that can be rendered on the server, improving performance and user experience. However, certain versions of the packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack are vulnerable to a denial of service attack, which can lead to excessive CPU usage and application crashes.
Vulnerability Detail
A denial of service vulnerability exists in React Server Components, specifically in the packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack, affecting versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4. The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints, causing excessive CPU usage for up to a minute before resulting in a catchable error. This can severely impact application performance and availability.
How To Fix
Latest published version: 19.3.1 as of 23 Oct 2026
npm install react-server-dom-parcel@19.3.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 19.0.0, < 19.0.519.0.5npm install react-server-dom-parcel@19.0.5 -
>= 19.1.0, < 19.1.619.1.6npm install react-server-dom-parcel@19.1.6 -
>= 19.2.0, < 19.2.519.2.5npm install react-server-dom-parcel@19.2.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If your application does not utilize a server or does not use a framework, bundler, or bundler plugin that supports React Server Components, it is not affected by this vulnerability. However, if you must continue using the vulnerable versions, consider implementing rate limiting on your server to mitigate the impact of potential denial of service attacks.
Conclusion
In summary, a denial of service vulnerability has been identified in specific versions of React Server Components. It is crucial to upgrade to the patched versions immediately to ensure the security and performance of your application. Utilize tools like Vulert to monitor for vulnerabilities and keep your software secure.
See every vulnerability recorded for react-server-dom-parcel →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The affected versions are react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
If you cannot upgrade immediately, consider implementing rate limiting on your server to help mitigate the effects of potential denial of service attacks.
Yes, if your application does not use a server or does not utilize a framework, bundler, or bundler plugin that supports React Server Components, it is not affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for react-server-dom-parcel.
