Denial-of-Service (DoS)

🗓️ 02 Feb 2026 14:13:51Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 11 Views

React Server Components server functions have a denial of service vulnerability from poor validation and resource handling, risking resource exhaustion.

Reporter	Title	Published	Views	Family All 35
Akamai Blog	CVE-2026-23864: React and Next.js Denial of Service via Memory Exhaustion	26 Jan 202612:00	–	akamaiblog
ATTACKERKB	CVE-2026-23864	26 Jan 202619:16	–	attackerkb
BDU FSTEC	The vulnerabilities of the React frontend building libraries React-server-dom-parcel, React-server-dom-turbopack, and React-server-dom-webpack allow attackers to cause service failures.	18 Feb 202600:00	–	bdu_fstec
Circl	CVE-2026-23864	26 Jan 202619:51	–	circl
CNNVD	Meta React Server Components security vulnerabilities	26 Jan 202600:00	–	cnnvd
CVE	CVE-2026-23864	26 Jan 202619:16	–	cve
Cvelist	CVE-2026-23864	26 Jan 202619:16	–	cvelist
EUVD	EUVD-2026-4673	29 Jan 202615:00	–	euvd
F5 Networks	K000159700: React framework vulnerability CVE-2026-23864	27 Jan 202602:09	–	f5
Github Security Blog	React Server Components have multiple Denial of Service Vulnerabilities	29 Jan 202615:00	–	github

Vulners

Node

react-server-dom-parcel react-server-dom-parcelRange19.1.0-canary-7130d0c6-20241212–19.1.4js

react-server-dom-parcel react-server-dom-parcelRange19.2.0-canary-63779030-20250328–19.2.3js

react-server-dom-parcel react-server-dom-parcelMatch19.0.0js

react-server-dom-parcel react-server-dom-parcelRange19.0.0–19.0.2js

react-server-dom-parcel react-server-dom-parcelRange19.0.0–19.0.3js

react-server-dom-turbopack react-server-dom-turbopackRange19.0.0-canary-2b036d3f1-20240327–19.0.3js

react-server-dom-turbopack react-server-dom-turbopackRange19.1.0-canary-130095f7-20241212–19.1.4js

react-server-dom-turbopack react-server-dom-turbopackRange19.2.0-canary-63779030-20250328–19.2.3js

react-server-dom-turbopack react-server-dom-turbopackRange19.1.0-canary-7130d0c6-20241212–19.1.4js

react-server-dom-turbopack react-server-dom-turbopackRange19.0.0–19.0.3js

react-server-dom-webpack react-server-dom-webpackRange19.2.0-canary-63779030-20250328–19.2.3js

react-server-dom-webpack react-server-dom-webpackRange19.0.0-canary-2b036d3f1-20240327–19.0.3js

react-server-dom-webpack react-server-dom-webpackRange19.1.0-canary-130095f7-20241212–19.1.4js

react-server-dom-webpack react-server-dom-webpackRange19.1.0-canary-7130d0c6-20241212–19.1.4js

react-server-dom-webpack react-server-dom-webpackRange19.0.0–19.0.3js

next nextRange13.0.0–15.0.7js

next nextRange15.1.0–15.1.11js

next nextRange15.2.0-canary.0–15.2.8js

next nextRange15.3.0-canary.0–15.3.8js

next nextRange15.4.0-canary.0–15.4.10js

next nextRange15.5.0–15.5.9js

next nextRange15.6.0-canary.0–15.6.0-canary.60js

next nextRange16.0.0-canary.0–16.0.10js

next nextRange16.1.0-canary.0–16.1.4js

Source	Link
react	www.react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
github	www.github.com/facebook/react/commit/10680271fab565e0edf948d3a6dc9d30e83df94c
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/security/cve/CVE-2026-23864
access	www.access.redhat.com/errata/RHSA-2026:34608
access	www.access.redhat.com/errata/RHSA-2026:13571
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23864.json
facebook	www.facebook.com/security/advisories/cve-2026-23864
github	www.github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg

01 Aug 2026 10:43Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.5

EPSS0.02393

SSVC