Multiple Vulnerabilities in React Server Components Enable DoS Attacks

Multiple critical security vulnerabilities have recently been disclosed in React Server Components. These flaws enable threat actors to launch Denial-of-Service (DoS) attacks against vulnerable servers.

The flaws, tracked as CVE-2026-23864 with a CVSS score of 7.5, are due to incomplete patches from previous security fixes and require immediate remediation.

Security researchers discovered additional attack vectors during testing the effectiveness of previous patches, demonstrating that multiple DoS vulnerabilities persist in the framework.

Vulnerability Details

The vulnerabilities affect three npm packages that handle React Server Components: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.

Attackers can exploit these flaws by sending specially crafted HTTP requests to Server Function endpoints, triggering server crashes, out-of-memory exceptions, or excessive CPU consumption.

The severity and impact of exploitation depend on the specific vulnerable code path being exercised, the application configuration, and the underlying application code.

Organizations using React frameworks and bundlers, such as Next.js, React Router, Waku, @parcel/rsc, @vite/rsc-plugin, and rwsdk, are exposed to these vulnerabilities.

The disclosure follows a pattern typical in critical vulnerability management, where initial patches are scrutinized by security researchers who probe adjacent code paths for bypass techniques.

This iterative process, while sometimes frustrating, represents a healthy security response cycle similar to what occurred after the Log4Shell vulnerability.

Affected Versions and Patches

Applications that do not use React Server Components or server-side React code remain unaffected by these vulnerabilities.

Similarly, applications without a framework, a bundler, or a bundler plugin that supports React Server Components face no risk.

According to the advisory published, React Native users operating in monorepo environments should update :

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.