CVE-2026-23870
Received Received - Intake
Denial of Service in React Server DOM Packages

Publication date: 2026-05-06

Last updated on: 2026-05-06

Assigner: Facebook, Inc.

Description
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-05-06
Generated
2026-05-07
AI Q&A
2026-05-06
EPSS Evaluated
N/A
NVD
CVE-2026-23870
EUVD
EUVD-2026-27867
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a denial of service (DoS) issue that can be triggered by sending specially crafted HTTP requests to certain server function endpoints.

When exploited, it can cause the server to crash, throw out-of-memory exceptions, or experience excessive CPU usage.

It affects specific versions of the packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.


How can this vulnerability impact me? :

The impact of this vulnerability is primarily a denial of service condition.

An attacker could cause your server to crash or become unresponsive by sending malicious HTTP requests.

This could lead to service outages, degraded performance due to high CPU usage, or resource exhaustion from out-of-memory errors.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart