Skip to content
OpenAdvisories
High · 7.5 CVE-2026-23864 EUVD-2026-4673GHSA-83fc-fqcc-2hmg

React Server Components have multiple Denial of Service Vulnerabilities

Published Jan 26, 2026 · Updated Jul 15, 2026 · Assigned by Meta

Vendor: Meta Product: react-server-dom-parcel Product: react-server-dom-turbopack Product: react-server-dom-webpack Package: react-server-dom-parcel Package: react-server-dom-turbopack Package: react-server-dom-webpack Ecosystem: npm

Description

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.

The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.

Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.

Affected products

VendorProductAffectedFixed
Meta react-server-dom-webpack 19.0.0 – < 19.0.4, 19.1.0 – < 19.1.5, 19.2.0 – < 19.2.4 19.0.4
Meta react-server-dom-turbopack 19.0.0 – < 19.0.4, 19.1.0 – < 19.1.5, 19.2.0 – < 19.2.4 19.0.4
Meta react-server-dom-parcel 19.0.0 – < 19.0.4, 19.1.0 – < 19.1.5, 19.2.0 – < 19.2.4 19.0.4

Affected packages

EcosystemPackageAffectedFixedRecord
npm react-server-dom-parcel >= 19.0.0, < 19.0.4 19.0.4 GHSA-83fc-fqcc-2hmg
npm react-server-dom-parcel >= 19.1.0-canary-7130d0c6-20241212, < 19.1.5 19.1.5 GHSA-83fc-fqcc-2hmg
npm react-server-dom-parcel >= 19.2.0-canary-63779030-20250328, < 19.2.4 19.2.4 GHSA-83fc-fqcc-2hmg
npm react-server-dom-turbopack >= 19.1.0-canary-7130d0c6-20241212, < 19.1.5 19.1.5 GHSA-83fc-fqcc-2hmg
npm react-server-dom-turbopack >= 19.0.0, < 19.0.4 19.0.4 GHSA-83fc-fqcc-2hmg
npm react-server-dom-turbopack >= 19.2.0-canary-63779030-20250328, < 19.2.4 19.2.4 GHSA-83fc-fqcc-2hmg
npm react-server-dom-webpack >= 19.2.0-canary-63779030-20250328, < 19.2.4 19.2.4 GHSA-83fc-fqcc-2hmg
npm react-server-dom-webpack >= 19.1.0-canary-7130d0c6-20241212, < 19.1.5 19.1.5 GHSA-83fc-fqcc-2hmg
npm react-server-dom-webpack >= 19.0.0, < 19.0.4 19.0.4 GHSA-83fc-fqcc-2hmg

Advisories 1

References