A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
References
| Link | Resource |
|---|---|
| https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Aug 2026, 15:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh - Vendor Advisory | |
| CWE | CWE-400 | |
| CPE | cpe:2.3:a:facebook:react-server-dom-parcel:*:*:*:*:*:node.js:*:* cpe:2.3:a:facebook:react-server-dom-turbopack:*:*:*:*:*:node.js:*:* cpe:2.3:a:facebook:react-server-dom-webpack:*:*:*:*:*:node.js:*:* |
|
| First Time |
Facebook react-server-dom-turbopack
Facebook react-server-dom-webpack Facebook react-server-dom-parcel |
06 May 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-06 17:16
Updated : 2026-08-12 15:51
NVD link : CVE-2026-23870
Mitre link : CVE-2026-23870
CVE.ORG link : CVE-2026-23870
JSON object : View
Products Affected
- react-server-dom-turbopack
- react-server-dom-webpack
- react-server-dom-parcel
CWE
CWE-400
Uncontrolled Resource Consumption