Vulnerability Details CVE-2026-23870
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
Exploit prediction scoring system (EPSS) score
EPSS Score 0.015
EPSS Ranking 72.6%
CVSS Severity
CVSS v3 Score 7.5
Products affected by CVE-2026-23870
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.0.0
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.0.1
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.0.2
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.0.3
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.0.4
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.0.5
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.1.0
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.1.1
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.1.2
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.1.3
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.1.4
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.1.5
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.1.6
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.2.0
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.2.1
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.2.2
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.2.3
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.2.4
-
cpe:2.3:a:facebook:react-server-dom-parcel:19.2.5
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.0.0
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.0.1
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.0.2
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.0.3
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.0.4
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.0.5
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.1.0
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.1.1
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.1.2
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.1.3
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.1.4
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.1.5
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.1.6
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.2.0
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.2.1
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.2.2
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.2.3
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.2.4
-
cpe:2.3:a:facebook:react-server-dom-turbopack:19.2.5
-
cpe:2.3:a:facebook:react-server-dom-webpack:19.0.1
-
cpe:2.3:a:facebook:react-server-dom-webpack:19.0.2
-
cpe:2.3:a:facebook:react-server-dom-webpack:19.0.3
-
cpe:2.3:a:facebook:react-server-dom-webpack:19.0.4
-
cpe:2.3:a:facebook:react-server-dom-webpack:19.1.1
-
cpe:2.3:a:facebook:react-server-dom-webpack:19.1.2
-
cpe:2.3:a:facebook:react-server-dom-webpack:19.1.3
-
cpe:2.3:a:facebook:react-server-dom-webpack:19.1.4
-
cpe:2.3:a:facebook:react-server-dom-webpack:19.1.5
-
cpe:2.3:a:facebook:react-server-dom-webpack:19.2.1
-
cpe:2.3:a:facebook:react-server-dom-webpack:19.2.2
-
cpe:2.3:a:facebook:react-server-dom-webpack:19.2.3
-
cpe:2.3:a:facebook:react-server-dom-webpack:19.2.4