Log in Start free

Vulnerability · Published Jan 26, 2026 · Assigned by Meta

CVE-2026-23864

High 7.5

In plain English

A high-severity unsafe deserialization in react-server-dom-parcel from Meta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.6%top 14.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code. Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmreact-server-dom-parcel19.0.4GHSA-83fc-fqcc-2hmg
npmreact-server-dom-parcel19.1.5GHSA-83fc-fqcc-2hmg
npmreact-server-dom-parcel19.2.4GHSA-83fc-fqcc-2hmg
npmreact-server-dom-turbopack19.0.4GHSA-83fc-fqcc-2hmg
npmreact-server-dom-turbopack19.2.4GHSA-83fc-fqcc-2hmg
npmreact-server-dom-turbopack19.1.5GHSA-83fc-fqcc-2hmg
npmreact-server-dom-webpack19.0.4GHSA-83fc-fqcc-2hmg
npmreact-server-dom-webpack19.1.5GHSA-83fc-fqcc-2hmg
npmreact-server-dom-webpack19.2.4GHSA-83fc-fqcc-2hmg

Affected products (as reported)

VendorProductVersions
Meta react-server-dom-webpack 19.0.0 – before 19.0.419.1.0 – before 19.1.519.2.0 – before 19.2.4
Meta react-server-dom-turbopack 19.0.0 – before 19.0.419.1.0 – before 19.1.519.2.0 – before 19.2.4
Meta react-server-dom-parcel 19.0.0 – before 19.0.419.1.0 – before 19.1.519.2.0 – before 19.2.4

Weakness: CWE-502, CWE-400, CWE-1284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References