CVE-2026-23870: High severity npm/react-server-dom-webpack vulnerability

Published May 6, 2026
·
Updated

Impact

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of:

react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack

Patches

Fixes were back ported to versions 19.0.6, 19.1.7, and 19.2.6.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References See the blog post for more information and upgrade instructions.

Other sources

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).

— NVD

Affected Software

21 affected componentsFixes available
npm/react-server-dom-webpack>=19.0.0<=19.0.5, >=19.1.0<=19.1.6, >=19.2.0<=19.2.5
npm/react-server-dom-parcel>=19.0.0<=19.0.5, >=19.1.0<=19.1.6, >=19.2.0<=19.2.5
npm/react-server-dom-turbopack>=19.0.0<=19.0.5, >=19.1.0<=19.1.6, >=19.2.0<=19.2.5
npm/react-server-dom-webpack>=19.2.0<19.2.6
19.2.6
npm/react-server-dom-turbopack>=19.2.0<19.2.6
19.2.6
npm/react-server-dom-parcel>=19.2.0<19.2.6
19.2.6
npm/react-server-dom-webpack>=19.1.0<19.1.7
19.1.7
npm/react-server-dom-turbopack>=19.1.0<19.1.7
19.1.7
npm/react-server-dom-parcel>=19.1.0<19.1.7
19.1.7
npm/react-server-dom-webpack>=19.0.0<19.0.6
19.0.6
npm/react-server-dom-turbopack>=19.0.0<19.0.6
19.0.6
npm/react-server-dom-parcel>=19.0.0<19.0.6
19.0.6
Facebook React-server-dom-parcel Node.js>=19.0.0<=19.0.5
Facebook React-server-dom-parcel Node.js>=19.1.0<=19.1.6
Facebook React-server-dom-parcel Node.js>=19.2.0<=19.2.5
Facebook React-server-dom-turbopack Node.js>=19.0.0<=19.0.5
Facebook React-server-dom-turbopack Node.js>=19.1.0<=19.1.6
Facebook React-server-dom-turbopack Node.js>=19.2.0<=19.2.5
Facebook React-server-dom-webpack Node.js>=19.0.0<=19.0.5
Facebook React-server-dom-webpack Node.js>=19.1.0<=19.1.6
Facebook React-server-dom-webpack Node.js>=19.2.0<=19.2.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/react-server-dom-webpack to a version that resolves this vulnerability.

    Fixed in 19.2.6
  2. Upgrade

    Upgrade npm/react-server-dom-turbopack to a version that resolves this vulnerability.

    Fixed in 19.2.6
  3. Upgrade

    Upgrade npm/react-server-dom-parcel to a version that resolves this vulnerability.

    Fixed in 19.2.6
  4. Upgrade

    Upgrade npm/react-server-dom-webpack to a version that resolves this vulnerability.

    Fixed in 19.1.7
  5. Upgrade

    Upgrade npm/react-server-dom-turbopack to a version that resolves this vulnerability.

    Fixed in 19.1.7
  6. Upgrade

    Upgrade npm/react-server-dom-parcel to a version that resolves this vulnerability.

    Fixed in 19.1.7
  7. Upgrade

    Upgrade npm/react-server-dom-webpack to a version that resolves this vulnerability.

    Fixed in 19.0.6
  8. Upgrade

    Upgrade npm/react-server-dom-turbopack to a version that resolves this vulnerability.

    Fixed in 19.0.6
  9. Upgrade

    Upgrade npm/react-server-dom-parcel to a version that resolves this vulnerability.

    Fixed in 19.0.6
  10. Upgrade

    Upgrade react-server-dom-webpack to a version that resolves this vulnerability.

    Fixed in 19.0.6
  11. Upgrade

    Upgrade react-server-dom-webpack to a version that resolves this vulnerability.

    Fixed in 19.1.7
  12. Upgrade

    Upgrade react-server-dom-webpack to a version that resolves this vulnerability.

    Fixed in 19.2.6
  13. Upgrade

    Upgrade react-server-dom-parcel to a version that resolves this vulnerability.

    Fixed in 19.0.6
  14. Upgrade

    Upgrade react-server-dom-parcel to a version that resolves this vulnerability.

    Fixed in 19.1.7
  15. Upgrade

    Upgrade react-server-dom-parcel to a version that resolves this vulnerability.

    Fixed in 19.2.6
  16. Upgrade

    Upgrade react-server-dom-turbopack to a version that resolves this vulnerability.

    Fixed in 19.0.6
  17. Upgrade

    Upgrade react-server-dom-turbopack to a version that resolves this vulnerability.

    Fixed in 19.1.7
  18. Upgrade

    Upgrade react-server-dom-turbopack to a version that resolves this vulnerability.

    Fixed in 19.2.6

Event History

May 6, 2026
CVE Published
via MITRE·04:24 PM
Data Sourced
via MITRE·04:24 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverity
Data Sourced
via NVD·05:16 PM
WeaknessAffected Software
May 11, 2026
Advisory Published
via GitHub·02:50 PM
Data Sourced
via GitHub·02:50 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-23870?

CVE-2026-23870 is classified as a denial of service vulnerability that can cause server crashes and excessive resource usage.

2

How do I fix CVE-2026-23870?

To fix CVE-2026-23870, upgrade to the latest versions of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.

3

Which versions are affected by CVE-2026-23870?

CVE-2026-23870 affects versions from 19.0.0 to 19.2.5 of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.

4

What type of attacks can CVE-2026-23870 facilitate?

CVE-2026-23870 can facilitate denial of service attacks that lead to server instability.

5

Is there a workaround for CVE-2026-23870?

Currently, the best course of action for CVE-2026-23870 is to apply the recommended software updates as there are no known effective workarounds.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203