React Server Components Vulnerability Lets Attackers Freeze Next.js Servers With a Single Request
CVE-2026-23870 lets attackers freeze React 19 Server Components and Next.js servers with one crafted POST.
CVE-2026-23870 (GHSA-rv78-f8rc-xrxh) is a high-severity denial-of-service flaw in React Server Components used by frameworks such as Next.js. Meta rates it CVSS 7.5. Nested $K form references make Server Action multipart parsing do roughly n² string comparisons, so a roughly 900 KB request can stall Node.js’s single event loop before authorization checks. Affected packages are react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel on React 19.0.0–19.0.5, 19.1.0–19.1.6, and 19.2.0–19.2.5. Patches in 19.0.6, 19.1.7, and 19.2.6 replace repeated scans with a shared traversal.
68