Critical React Server Components Vulnerability Enables DoS Attacks

Key Takeaways

• A critical vulnerability (CVE-2026-23869) has been identified in React Server Components.
• The flaw allows unauthenticated remote attackers to launch Denial of Service (DoS) attacks by exhausting server resources.
• Affected applications utilize specific React server packages in their production environments.
• Patches are available; developers should update to versions 19.0.5, 19.1.6, or 19.2.5 immediately.

A significant security flaw has been uncovered within React Server Components, leaving modern web applications susceptible to Denial of Service (DoS) attacks. This high-severity vulnerability, tracked as CVE-2026-23869, enables unauthenticated remote attackers to deplete backend server resources through specially crafted network requests.

The GitHub Security Advisory has rated this vulnerability as High severity. Its exploitability is simplified by requiring low attack complexity, no user interaction, and no elevated privileges, posing an immediate threat to production environments running vulnerable React server packages.

Mechanism of the Attack

The vulnerability specifically targets how React Server Components process incoming data at Server Function endpoints. An attacker can exploit this by transmitting a malicious HTTP request directly to these endpoints over the network. Upon receipt of this payload, the server encounters two distinct security weaknesses:

• Deserialization of untrusted data (CWE-502): The system processes potentially dangerous input without adequate validation.
• Uncontrolled resource consumption (CWE-400): The server attempts to handle the complex or malformed payload, leading to excessive resource usage.

This combination forces the server to experience a significant CPU spike, lasting up to a full minute. While the process ultimately resolves into a catchable error rather than a complete system crash, this prolonged CPU utilization severely degrades application performance and blocks access for legitimate users, effectively constituting a DoS.

Affected Components and Versions

The core packages responsible for server-side rendering and component routing are where the vulnerability resides. The flaw impacts React’s 19.0, 19.1, and 19.2 release branches. Specifically, the following npm packages are vulnerable:

• react-server-dom-parcel: Versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4.
• react-server-dom-turbopack: Versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4.
• react-server-dom-webpack: Versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4.

It is important to note that not all React applications face this threat. The architectural design of a project determines its exposure. Applications where React code operates exclusively on the client side without any server components are not affected. Similarly, if an application does not use a framework, bundler, or plugin that explicitly supports React Server Components, its infrastructure remains secure from this specific vulnerability.

The React maintenance team has already released security fixes to address this resource exhaustion flaw. Development teams are strongly advised to audit their dependencies and upgrade immediately to restore security. The secure versions to update to are 19.0.5, 19.1.6, and 19.2.5.

What You Should Do

• Identify Vulnerable Packages: Check if your project uses react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack within the specified vulnerable version ranges.
• Upgrade Immediately: Update all affected packages to their patched versions: 19.0.5, 19.1.6, or 19.2.5.
• Audit Your Architecture: Confirm whether your application utilizes React Server Components. If your application is purely client-side or does not integrate with frameworks supporting RSCs, you are likely not affected.
• Monitor GitHub Advisories: Regularly review the official GitHub Security Advisory for any further updates or related information.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.