Plattform
nodejs
Komponente
react-server-dom-parcel
Behoben in
19.2.5
19.2.5
19.2.5
19.2.5
19.2.5
19.2.5
19.2.5
19.2.5
19.2.5
19.0.5
A denial-of-service (DoS) vulnerability has been identified in React Server Components, specifically impacting the react-server-dom-parcel package. Attackers can exploit this flaw by sending specially crafted HTTP requests to Server Function endpoints, resulting in excessive CPU usage and potential application instability. The vulnerability affects versions 19.0.0 through 19.2.0, and a fix is available in version 19.0.5.
This vulnerability allows an attacker to disrupt the availability of applications utilizing React Server Components. The crafted HTTP requests trigger a resource exhaustion scenario, consuming significant CPU resources for up to a minute before resulting in a thrown error. While the error is catchable, the preceding CPU spike can severely degrade performance and potentially crash the server. The impact is particularly severe in production environments with high traffic volumes, as a successful attack could render the application unresponsive to legitimate users. This vulnerability shares similarities with other resource exhaustion attacks targeting server-side components, highlighting the importance of input validation and rate limiting.
This vulnerability was publicly disclosed on 2026-04-10. There is currently no indication of active exploitation in the wild, but the ease of crafting the malicious HTTP request suggests a potential for future attacks. The vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept code is likely to emerge, increasing the risk of exploitation.
Applications utilizing React Server Components and relying on the vulnerable react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack packages are at risk. This includes projects using modern React development workflows and those deploying Server Functions to handle backend logic. Specifically, teams with limited resources or those running applications on shared hosting environments are particularly vulnerable due to the potential for resource exhaustion.
• nodejs / server: Monitor CPU utilization on servers running react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. Look for sustained high CPU usage without corresponding user activity.
top -n 1 | grep -E 'react-server-dom-parcel|react-server-dom-turbopack|react-server-dom-webpack'• nodejs / server: Examine application logs for errors related to excessive CPU usage or exceptions thrown within Server Function endpoints.
grep -i 'cpu usage|server function error' /var/log/app/application.log• generic web: Monitor HTTP request patterns to Server Function endpoints for unusual activity, such as a sudden surge in requests from a single IP address.
curl -v <server_function_endpoint> # Examine request/response headers for anomaliesdisclosure
Exploit-Status
EPSS
0.42% (62% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation is to immediately upgrade react-server-dom-parcel to version 19.0.5 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing temporary workarounds such as rate limiting on Server Function endpoints to restrict the number of requests from a single source. Additionally, implement robust input validation to filter out potentially malicious requests. Monitoring CPU usage on the server is crucial to detect potential attacks. While a direct detection signature is difficult to create, increased CPU load on Server Function endpoints should be investigated. After upgrade, confirm the fix by sending a test payload and verifying that CPU usage remains within acceptable limits.
Aktualisieren Sie das Paket react-server-dom-turbopack auf Version 19.2.5 oder höher, um die Denial of Service Vulnerability zu mindern. Dieses Update behebt das Problem, indem es die durch speziell gestaltete HTTP-Anfragen verursachte übermäßige CPU-Auslastung verhindert. Stellen Sie sicher, dass Sie Ihre Anwendung nach dem Update gründlich testen.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2026-23869 is a denial-of-service vulnerability affecting react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. It allows attackers to cause excessive CPU usage through crafted HTTP requests.
You are affected if you are using versions 19.0.0 through 19.2.0 of react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack in your React Server Components application.
Upgrade to version 19.0.5 or later of react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. Consider rate limiting and WAF rules as temporary mitigations.
While no active exploitation has been confirmed, the ease of crafting malicious requests suggests a potential for rapid exploitation.
Refer to the official React security advisory for details and updates: [https://react.dev/security](https://react.dev/security)
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.