The vulnerabilities of the React frontend building libraries React-server-dom-parcel, React-server-dom-turbopack, and React-server-dom-webpack allow attackers to cause service failures.

🗓️ 12 May 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Vulnerabilities in React server dom libraries allow service failure from uncontrolled resource consumption via crafted requests.

Reporter	Title	Published	Views	Family All 32
GithubExploit	Exploit for CVE-2026-23870	7 May 202623:00	–	githubexploit
ATTACKERKB	CVE-2026-23870	6 May 202616:24	–	attackerkb
Circl	CVE-2026-23870	6 May 202617:21	–	circl
CNNVD	Meta多款产品安全漏洞	6 May 202600:00	–	cnnvd
CVE	CVE-2026-23870	6 May 202616:24	–	cve
Cvelist	CVE-2026-23870	6 May 202616:24	–	cvelist
EUVD	EUVD-2026-27867	11 May 202614:50	–	euvd
Github Security Blog	Next.js Vulnerable to Denial of Service with Server Components	11 May 202614:50	–	github
Github Security Blog	Facebook React has a Denial of Service Vulnerability in React Server Components	11 May 202614:50	–	github
Github Security Blog	@vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components	11 May 202614:50	–	github

Vulners

Node

meta_platforms react-server-dom-parcelMatch19.0.0

OR

meta_platforms react-server-dom-parcelMatch19.0.1

OR

meta_platforms react-server-dom-parcelMatch19.0.2

OR

meta_platforms react-server-dom-parcelMatch19.0.3

OR

meta_platforms react-server-dom-parcelMatch19.0.4

OR

meta_platforms react-server-dom-parcelMatch19.0.5

OR

meta_platforms react-server-dom-parcelMatch19.1.0

OR

meta_platforms react-server-dom-parcelMatch19.1.1

OR

meta_platforms react-server-dom-parcelMatch19.1.2

OR

meta_platforms react-server-dom-parcelMatch19.1.3

OR

meta_platforms react-server-dom-parcelMatch19.1.4

OR

meta_platforms react-server-dom-parcelMatch19.1.5

OR

meta_platforms react-server-dom-parcelMatch19.1.6

OR

meta_platforms react-server-dom-parcelMatch19.2.0

OR

meta_platforms react-server-dom-parcelMatch19.2.1

OR

meta_platforms react-server-dom-parcelMatch19.2.2

OR

meta_platforms react-server-dom-parcelMatch19.2.3

OR

meta_platforms react-server-dom-parcelMatch19.2.4

OR

meta_platforms react-server-dom-parcelMatch19.2.5

OR

meta_platforms react-server-dom-turbopackMatch19.0.0

OR

meta_platforms react-server-dom-turbopackMatch19.0.1

OR

meta_platforms react-server-dom-turbopackMatch19.0.2

OR

meta_platforms react-server-dom-turbopackMatch19.0.3

OR

meta_platforms react-server-dom-turbopackMatch19.0.4

OR

meta_platforms react-server-dom-turbopackMatch19.0.5

OR

meta_platforms react-server-dom-turbopackMatch19.1.0

OR

meta_platforms react-server-dom-turbopackMatch19.1.1

OR

meta_platforms react-server-dom-turbopackMatch19.1.2

OR

meta_platforms react-server-dom-turbopackMatch19.1.3

OR

meta_platforms react-server-dom-turbopackMatch19.1.4

OR

meta_platforms react-server-dom-turbopackMatch19.1.5

OR

meta_platforms react-server-dom-turbopackMatch19.1.6

OR

meta_platforms react-server-dom-turbopackMatch19.2.0

OR

meta_platforms react-server-dom-turbopackMatch19.2.1

OR

meta_platforms react-server-dom-turbopackMatch19.2.2

OR

meta_platforms react-server-dom-turbopackMatch19.2.3

OR

meta_platforms react-server-dom-turbopackMatch19.2.4

OR

meta_platforms react-server-dom-turbopackMatch19.2.5

OR

meta_platforms react-server-dom-webpackMatch19.0.0

OR

meta_platforms react-server-dom-webpackMatch19.0.1

OR

meta_platforms react-server-dom-webpackMatch19.0.2

OR

meta_platforms react-server-dom-webpackMatch19.0.3

OR

meta_platforms react-server-dom-webpackMatch19.0.4

OR

meta_platforms react-server-dom-webpackMatch19.0.5

OR

meta_platforms react-server-dom-webpackMatch19.1.0

OR

meta_platforms react-server-dom-webpackMatch19.1.1

OR

meta_platforms react-server-dom-webpackMatch19.1.2

OR

meta_platforms react-server-dom-webpackMatch19.1.3

OR

meta_platforms react-server-dom-webpackMatch19.1.4

OR

meta_platforms react-server-dom-webpackMatch19.1.5

OR

meta_platforms react-server-dom-webpackMatch19.1.6

OR

meta_platforms react-server-dom-webpackMatch19.2.0

OR

meta_platforms react-server-dom-webpackMatch19.2.1

OR

meta_platforms react-server-dom-webpackMatch19.2.2

OR

meta_platforms react-server-dom-webpackMatch19.2.3

OR

meta_platforms react-server-dom-webpackMatch19.2.4

OR

meta_platforms react-server-dom-webpackMatch19.2.5

Source	Link
github	www.github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh
web	www.web.nvd.nist.gov/view/vuln/detail

12 May 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 37.5

CVSS 27.8

EPSS0.01533

React-server-dom-parcel React-server-dom-turbopack React-server-dom-webpack uncontrolled-resource-consumption crafted-requests service-failures