> CVE-2026-23864

« BACK_TO_HOME
PUBLISHED
2026-01-26 20:16
MODIFIED
2026-01-26 20:16
EPSS (Prob. Exploit)
2.58%
Top 14.7%
DATA SOURCES:
NVD 🔗 2026-01-26 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code. Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Streams for Apache Kafka 3.2.0 release and security update
Streams for Apache Kafka 3.2.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scorin...
Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update
Streams for Apache Kafka 2.9.4 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scorin...

> GITHUB SECURITY ADVISORY

GHSA-83fc-fqcc-2hmg HIGH

React Server Components have multiple Denial of Service Vulnerabilities

AFFECTED PACKAGES:
NPM / react-server-dom-turbopack
>= 19.2.0-canary-63779030-20250328, < 19.2.4
Fixed in: 19.2.4
NPM / react-server-dom-webpack
>= 19.0.0, < 19.0.4
Fixed in: 19.0.4
NPM / react-server-dom-webpack
>= 19.1.0-canary-7130d0c6-20241212, < 19.1.5
Fixed in: 19.1.5
NPM / react-server-dom-parcel
>= 19.2.0-canary-63779030-20250328, < 19.2.4
Fixed in: 19.2.4
NPM / react-server-dom-parcel
>= 19.1.0-canary-7130d0c6-20241212, < 19.1.5
Fixed in: 19.1.5
NPM / react-server-dom-turbopack
>= 19.0.0, < 19.0.4
Fixed in: 19.0.4
NPM / react-server-dom-webpack
>= 19.2.0-canary-63779030-20250328, < 19.2.4
Fixed in: 19.2.4
NPM / react-server-dom-turbopack
>= 19.1.0-canary-7130d0c6-20241212, < 19.1.5
Fixed in: 19.1.5
NPM / react-server-dom-parcel
>= 19.0.0, < 19.0.4
Fixed in: 19.0.4

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
13 versions affected
ALIASES:
GHSA-83fc-fqcc-2hmg

> HISTORIQUE DES MODIFICATIONS

Première apparition
26/01/2026 20:16
Source: NVD
Total des modifications: 0 Dernière mise à jour: 9 months ago

> REFERENCES

https://www.facebook.com/security/advisories/cve-2026-23864
« BACK_TO_HOME