Log in Start free

Vulnerability · Published May 6, 2026 · Assigned by Meta

CVE-2026-23870

High 7.5

In plain English

A high-severity security flaw in react-server-dom-parcel from Meta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.5%top 25.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmreact-server-dom-parcel19.1.7GHSA-rv78-f8rc-xrxh
npmreact-server-dom-parcel19.0.6GHSA-rv78-f8rc-xrxh
npmreact-server-dom-parcel19.2.6GHSA-rv78-f8rc-xrxh
npmreact-server-dom-turbopack19.1.7GHSA-rv78-f8rc-xrxh
npmreact-server-dom-turbopack19.0.6GHSA-rv78-f8rc-xrxh
npmreact-server-dom-turbopack19.2.6GHSA-rv78-f8rc-xrxh
npmreact-server-dom-webpack19.0.6GHSA-rv78-f8rc-xrxh
npmreact-server-dom-webpack19.2.6GHSA-rv78-f8rc-xrxh
npmreact-server-dom-webpack19.1.7GHSA-rv78-f8rc-xrxh

Affected products (as reported)

VendorProductVersions
Meta react-server-dom-turbopack 19.0.0 – through 19.0.519.1.0 – through 19.1.619.2.0 – through 19.2.5
Meta react-server-dom-parcel 19.0.0 – through 19.0.519.1.0 – through 19.1.619.2.0 – through 19.2.5
Meta react-server-dom-webpack 19.0.0 – through 19.0.519.1.0 – through 19.1.619.2.0 – through 19.2.5

References