Next.js: denial of service with a single HTTP request

A researcher discovered a vulnerability CVE-2026-23870 in React Server Components used in Next.js and other React applications. The flaw occurs when processing form data passed to server functions (Server Actions): due to an inefficient input-parsing algorithm, the server performs an excessive number of operations. As a result, even a single specially crafted HTTP request can block the processing of other requests for an extended period.

To exploit the vulnerability, an attacker sends a POST request containing a large number of form fields and references to nested forms. When processing each such reference, React scans the entire list of fields again, causing the processing complexity to grow quadratically. In the study, a request of approximately 900 KB triggered around 100 million string checks and halted the processing of other requests for approximately four seconds in the test configuration. In an environment with a load balancer, three consecutive requests caused the server to be removed from the pool of available nodes.

An attacker can disrupt web application availability by blocking the processing of legitimate requests and triggering 503 errors. If the vulnerable server function is accessible without authentication, the attack can be carried out without an account; otherwise, a regular user account may be required. Repeating the requests can extend the outage and disrupt the service for other users.

Article: https://simonkoeck.com/writeups/react-rsc-formdata-event-loop-dos