CVE-2026-23864

HIGH

7.5

CVSS Score

Published: January 26, 2026 at 07:16 PM UTC

Updated: July 15, 2026 at 02:18 AM UTC

4 products affected across 1 vendorReactReact Server Dom WebpackReact Server Dom Parcel

Using react-server-dom-webpack by Meta?

Get instant alerts when new vulnerabilities affect react-server-dom-webpack - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 3%

SSVC

No known exploit

Description

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code. Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

React · Facebook

95%

19.0.0 ≤ v < 19.0.419.1.0 ≤ v < 19.1.519.2.0 ≤ v < 19.2.4

Affected range stops below 19.0.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.1.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.2.4, so it looks safe — our inference, not a vendor statement

React Server Dom Parcel · Facebooknpm

60%

19.0.0 ≤ v < 19.0.419.1.0 ≤ v < 19.1.519.2.0 ≤ v < 19.2.419.0.0 19.1.0 19.2.0

Affected range stops below 19.0.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.1.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.2.4, so it looks safe — our inference, not a vendor statement

React Server Dom Turbopack · Facebooknpm

60%

19.0.0 ≤ v < 19.0.419.1.0 ≤ v < 19.1.519.2.0 ≤ v < 19.2.419.0.0 19.1.0 19.2.0

Affected range stops below 19.0.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.1.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.2.4, so it looks safe — our inference, not a vendor statement

React Server Dom Webpack · Facebooknpm

60%

19.0.0 ≤ v < 19.0.419.1.0 ≤ v < 19.1.519.2.0 ≤ v < 19.2.419.0.0 19.1.0 19.2.0

Affected range stops below 19.0.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.1.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.2.4, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://www.facebook.com/security/advisories/cve-2026-23864