Multiple denial of service (DoS) vulnerabilities have been discovered in React Server Components, affecting several widely used npm packages.
The flaws, disclosed on January 26, 2026, expose applications using React Server Components to potential server crashes, memory exhaustion, and excessive CPU consumption, prompting urgent security updates across affected versions.
Critical Vulnerability Details
Security researchers identified that previous patches addressing DoS vulnerabilities in React Server Components were incomplete, leaving applications exposed to new attack vectors.
The vulnerabilities affect three core packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, with exploitation requiring specially crafted HTTP requests sent to Server Function endpoints.
| CVE ID | Severity | CVSS Score | Attack Vector |
|---|---|---|---|
| CVE-2026-23864 | High | 7.5 | Network |
The attack mechanism involves malicious requests that can trigger infinite loops, causing server processes to hang and consume CPU resources indefinitely.
Attackers can send specially crafted network requests with low complexity, requiring no privileges or user interaction to execute the attack.
The vulnerability impacts system availability while leaving confidentiality and integrity unaffected.
Affected Packages and Versions
Even applications without implemented React Server Function endpoints remain vulnerable if they support React Server Components architecture.
The flaw represents an incomplete fix from earlier security patches, demonstrating how initial remediation efforts failed to address all attack vectors.
| Package | Affected Versions | Patched Versions |
|---|---|---|
| react-server-dom-webpack | 19.0.0-19.0.3, 19.1.0-19.1.4, 19.2.0-19.2.3 | 19.0.4, 19.1.5, 19.2.4 |
| react-server-dom-parcel | 19.0.0-19.0.3, 19.1.0-19.1.4, 19.2.0-19.2.3 | 19.0.4, 19.1.5, 19.2.4 |
| react-server-dom-turbopack | 19.0.0-19.0.3, 19.1.0-19.1.4, 19.2.0-19.2.3 | 19.0.4, 19.1.5, 19.2.4 |
The React team has released emergency security patches to address these critical flaws. Applications running versions 19.0.0 through 19.0.3, 19.1.0 through 19.1.4, and 19.2.0 through 19.2.3 are vulnerable and require immediate updates to patched versions 19.0.4, 19.1.5, or 19.2.4.
Framework Impact and Remediation
Affected frameworks and bundlers include Next.js, React Router, Waku, @parcel/rsc, @vite/rsc-plugin, and rwsdk.
Organizations previously updated to versions 19.0.3, 19.1.4, or 19.2.3 must apply new patches, as those releases contain incomplete fixes that still leave systems exposed to exploitation.
The React team recommends immediate upgrades to the latest patched versions. Administrators should prioritize updating production environments running React Server Components to prevent potential service disruptions.
Applications not using server-side React code or React Server Components remain unaffected by these vulnerabilities and do not require updates.
The disclosure highlights the complexity of securing modern JavaScript frameworks and the importance of thorough security testing when implementing patches.
Development teams should review their dependency chains and ensure all React Server Component packages are updated to the latest secure versions.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
.webp?fit=1600,900&ssl=1&description=The flaws, disclosed on January 26, 2026, expose applications using React Server Components to potential server crashes, memory exhaustion){kind=link}